Motivation

#240 added the offline resolver chain; #242 added pinned-git resolution via bare clones. Many real-world Terraform repos still reference registry modules (registry.terraform.io/...) and other remote URLs that require a network fetch to materialize .tf content.

This PR completes the resolver library side of remote module support. Nothing in the scan path invokes these resolvers yet, that wiring is a follow-up.

Related Ticket: K9CODESEC-2947

Changes

Go-getter resolver

Adds GoGetterResolver on top of hashicorp/go-getter for generic remote downloads (git, HTTP, S3, etc.). Includes global and per-host concurrency limits (IAC_MODULE_FETCH_CONCURRENCY, IAC_MODULE_HOST_FETCH_CONCURRENCY), a 200 MiB scan-level download cap(don't ask me why this value), host allowlists, transient-error retries, and integration with the shared on-disk moduleCache (content-addressed by source + resolved version).

Registry HTTP layer

Adds registry discovery, version resolution, and download-URL translation for public and private registries (TF_TOKEN_* auth). Go-getter depends on this layer, registry sources are translated to X-Terraform-Get URLs before download, which is why both land in one PR.

Source routing

Pinned git::...?ref= sources stay on BareGitResolver (go-getter explicitly defers them). Unpinned git::https:// sources keep HTTPS transport instead of being rewritten to SSH. Registry sources with subdirectories (ns/name/provider//subdir) are classified correctly. Pinned registry versions skip network discovery when resolving the cache key, so offline cache hits work.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

CI should pass.

Impact

Additive only: new code under pkg/parser/terraform/modules/resolver, plus go.mod/go.sum and LICENSE-3rdparty.csv for go-getter transitive deps. No CLI, scan, or engine behavior changes.

Additional Notes

I submit this contribution under the Apache-2.0 license.