tf-provider-pin-check — fail CI when Terraform versions float

A fast CI check that fails when any Terraform provider or module reference is not pinned to an explicit version.