terraform apply: restore marks after unknown validation

[liamcervante]

This PR updates the order of validations that happen after an ApplyResourceChange operation. Previously, we restored the sensitive marks on the new value before validating that is was wholly known. If the value was not wholly known, then a panic might occur during the UnknownAsNull fix up call that ensures there are no unknown values present.

Now, we restore the sensitive marks only after this validation has been completed. This ensures there are no sensitive marks during the UnknownAsNull function call.

This change should be safe as only validations occur between the old point and new point of mark reapplication. The attributes within the value are not exposed by these validations.

Fixes #35039

Target Release

1.8.2

Draft CHANGELOG entry

ENHANCEMENTS

• terraform apply: Prevent panic when a provider erroneously provides

[jbardin]

UnknownAsNull doesn't externally appear to transform the value outside of the cty realm, so I think should be able to accept marked values. The fact that it retains some marks, drops marks from unknown values, and panics if a only a map is marked seems like an inconsistency we should fix upstream.

[jbardin]

This looks good in general here, since it's only delaying the applications of marks until after some more error checking, but we should check if the upstream behavior is correct in the first place.

[github-actions]

Reminder for the merging maintainer: if this is a user-visible change, please update the changelog on the appropriate release branch.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.