fix(query): allow Terraform local secret references

[omribz156]

Closes #7277

Reason for Proposed Changes

• Terraform local references such as password = local.rds_password and services_environment_variables_secret = local.services_environment_variables_secret are currently treated as literal password/secret values by the generic password and secret regex checks.

Proposed Changes

• Add a focused global allow rule for plain Terraform local.* references.
• Keep the existing positive conditional-local fixture flagged by requiring the local reference to be the whole assigned value.
• Add a negative Terraform fixture covering the issue examples.

Verification:

• go test ./test -run TestSecretsQuery -count=1
• git diff --check

This was implemented with Codex assistance, with the final patch manually reviewed and kept focused.

I submit this contribution under the Apache-2.0 license.