fix: resolve access policy and AOP certificate migration bugs

[tamas-jozsa]

Problem 1: authenticated_origin_pulls — cert_id still references old resource type

When cloudflare_authenticated_origin_pulls_certificate resources with type = "per-hostname" are renamed to cloudflare_authenticated_origin_pulls_hostname_certificate, the cert_id attribute in cloudflare_authenticated_origin_pulls resources using for_each was not updated — leaving references like cloudflare_authenticated_origin_pulls_certificate.cert[each.key].id pointing at a resource type that no longer exists in the v5 provider.

Fix: GetResourceRename for authenticated_origin_pulls_certificate now returns cloudflare_authenticated_origin_pulls_hostname_certificate as the rename target, so the global cross-file postprocessor correctly renames all cert_id references including for_each indexed ones. The heuristic name-based Postprocess fallback was removed.

---

Problem 2: zero_trust_access_policy — service_token list not converted to {token_id=...} object

service_token = [resource.name.id] inside include blocks was not being converted to service_token = { token_id = resource.name.id }. The migrator was silently producing broken output.

Root cause: Two issues:

1. service_token was not in the arrayAttrs map in expandArrayAttribute
2. buildExprTokens for ScopeTraversalExpr only serialized the root identifier, silently dropping .id, [each.key], and all other traversal steps

Fix: Added service_token → token_id to arrayAttrs. Fixed buildExprTokens to serialize the full traversal chain, and added handlers for RelativeTraversalExpr, IndexExpr, and FunctionCallExpr so references like resource.name[each.key].id are correctly preserved in all include/exclude/require conditions.

---

Already working (test coverage added)

The following transformations were already producing correct output — test cases added to prevent regression:

• include {} block → include = [{ ... }] attribute list conversion
• email_domain = ["domain"] → { domain = "domain" } object conversion (single and multiple domains)
• any_valid_service_token = true → {} empty object conversion

---

application_id / precedence removal

application_id and precedence are correctly removed from policies with a diagnostic warning explaining that application-scoped policies must be manually converted to inline policies = [...] blocks on the linked cloudflare_zero_trust_access_application. Full automation is not possible since it requires cross-resource modification.

---

E2E test improvements

• Added scoped _e2e.tf files for authenticated_origin_pulls (per-hostname cert resources require valid real certificates) and zero_trust_access_policy (service token and application-scoped resources require real credentials)
• Added drift exemptions:
  • zero_trust_access_policy: session_duration is removed from v5 policies; the API normalizes it to "24h" — one-time drift that resolves after first apply
  • zero_trust_dlp_predefined_profile: name and open_access are Computed-only in v5 and show as (known after apply) on the first plan — one-time drift

---

========================================
✓ E2E Test Complete!
========================================

Summary:

  Step 1: v4 terraform apply
    Status: ✓ SUCCESS

  Step 2: Migration (v4 → v5)
    Status: ✓ SUCCESS

  Step 3: v5 plan (before apply)
    Status: ✓ SUCCESS - Drift matched exemptions
    Result: 17 material changes (17 matched exemptions, 0 unmatched)
    Terraform: Plan: 16 to import, 6 to add, 7 to change, 0 to destroy.

  Step 4: v5 terraform apply
    Status: ✓ SUCCESS

  Step 5: v5 plan (after apply)
    Status: ✓ SUCCESS - Stable state achieved
    Result: 7 material changes matched exemptions (0 unmatched)

Logs saved to:
  - /Users/tjozsa/cf-repos/sdks/migration-work/agent-a/tf-migrate/e2e/tmp