Support for provisioners in removed blocks

[jbardin]

During the apply phase, we'll check if there are provisioners either in the matching resource block or the matching removed block -- whichever of the two is present -- and execute the destroy-time subset of them either way.

This also establishes a standard way to attach a removed block to a NodeResourceAbstract when one is defined, which is likely to be useful for supporting other resource-related meta arguments in removed blocks in future.

removed {
  from = aws_instance.example

  provisioner "local-exec" {
    # All provisioners must have when = destroy in this context,
    # because "removed" resources can only be destroyed.
    when = destroy

    # ...
  }
}

References within the destroy provisioner will be limited in scope just as if it were written within the original resource block, meaning that only count.index, each.key, and self will be valid identifiers. Terraform will not be able to validate wether count.index or each.key will be valid beforehand, because the instances being destroyed could technically have either if the configuration had been changed between count and for_each and failed to delete, so it is up to the user to ensure any references to those values are correct for the instances being destroyed.

If the user specifies destroy = false in the removed lifecycle, then the provisioner will not be be executed, as there is no destroy step during which to execute it.

Closes #34711
Closes #13549

[github-actions]

Reminder for the merging maintainer: if this is a user-visible change, please update the changelog on the appropriate release branch.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.