fix(terraform): normalize lock file constraint order after provider update

[lindeskar]

Changes

Terraform and OpenTofu require the constraints field in .terraform.lock.hcl to be written in normalized form. When Renovate updates a provider version, getNewConstraint replaces the version in place but does not re-sort the sub-constraints.

When a provider's constraint combines an exact pin (from required_providers) with a ~> range inherited from a module, bumping the pin can push it past the range boundary — e.g. 5.0.0, ~> 5.0 becomes 5.9.0, ~> 5.0. That is no longer normalized, so terraform/tofu init fails:

The recorded version constraints for provider registry.terraform.io/hashicorp/vault must be written in normalized form: "~> 5.0, 5.9.0".

This adds sortConstraints, which reorders the sub-constraints into Terraform's canonical order — boundary version ascending, ties broken by operator priority — mirroring getproviders.VersionConstraintsString in Terraform. It only reorders existing tokens (it never rewrites operators or version precision) and returns the string untouched if any token cannot be parsed, so it cannot corrupt a valid constraint. It is applied at the two in-place replacement branches of getNewConstraint.

Context

Please select one of the following:

• This closes an existing Issue, Closes: Updated constraints in Terraform lock file have to be normalized #37273
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

This PR was written primarily by Claude Code (model: Claude Opus 4.8) — the code, tests, and this description. The approach was directed and reviewed by me, including cross-checking the sort order against Terraform's getproviders.VersionConstraintsString.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository: N/A (unit tests only; not yet run against a live repository)

[cla-assistant]

All committers have signed the CLA.

[lindeskar]

Hi maintainers,

Sorry I had to force-push once to change the commit message.

Let me know if there's anything missing to get this change through!

/Alex