fix(terraform): CKV_GCP_13 pass when client_certificate_config is omitted

[arpitjain099]

Fixes #7558

Problem

CKV_GCP_13 ("Ensure client certificate authentication to Kubernetes Engine Clusters is disabled") fails on any google_container_cluster that does not explicitly set:

master_auth {
  client_certificate_config {
    issue_client_certificate = false
  }
}

That is a false positive. The google provider defaults issue_client_certificate to false, so a cluster that omits the block entirely already has client certificate authentication disabled. The check was penalizing the safer pattern (rely on the secure default) and rewarding boilerplate (declare an empty block just to satisfy the scanner).

Provider default evidence

• google provider resource docs, master_auth.client_certificate_config.issue_client_certificate: "Whether client certificate authorization is enabled for this cluster ... Defaults to false." https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#issue_client_certificate
• GKE REST API reference, MasterAuth.clientCertificateConfig.issueClientCertificate defaults to disabled: https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.zones.clusters#masterauth
• Client cert auth has been disabled by default since GKE 1.12 (Nov 2018), and all versions at or below 1.12 are long out of support, so no currently-creatable cluster issues client certificates by default: https://cloud.google.com/kubernetes-engine/docs/release-notes#november_28_2018

Root cause

GKEClientCertificateDisabled extends BaseResourceValueCheck without setting missing_block_result, which defaults to CheckResult.FAILED. When the inspected key is absent, scan_resource_conf returns missing_block_result, so an omitted-but-secure block is reported as a failure.

Fix

Pass missing_block_result=CheckResult.PASSED. An omitted block now passes (matching the provider default), while an explicit issue_client_certificate = true still fails.

Repro / before and after

resource "google_container_cluster" "implicit" {
  name     = "implicit"
  location = "us-central1"
}

Before: FAILED for resource: google_container_cluster.implicit
After: PASSED for resource: google_container_cluster.implicit

An explicit issue_client_certificate = true remains FAILED (existing test_failure is unchanged).

Tests

Added test_success_omitted_block asserting an omitted block passes. Verified the new test fails against the unpatched check and passes with the fix; the existing pass/fail cases are unchanged.

tests/terraform/checks/resource/gcp/test_GKEClientCertificateDisabled.py ... 3 passed