Add option to terraform-to-secrets to search for secrets in remote state resources

[dav3r]

🗣 Description

This PR adds a new --remote-state option to the terraform-to-secrets script. When the option is included, the script will search for secrets in Terraform remote state resources. When the option is excluded, it will only search for secrets in the local state resources. This changes the behavior of terraform-to-secrets because it would previously search in the remote state by default.

💭 Motivation and context

There are some cases when it may be desirable to search for secrets in remote state resources, but generally, we will only want to search the local state.

This change was prompted by a situation (in cisagov/ansible-role-cdm-nessus-agent#62) where the intended TEST_ROLE_TO_ASSUME for the ansible-role-cdm-nessus-agent was being overwritten by an additional TEST_ROLE_TO_ASSUME that was included in the remote state for ansible-role-cdm-certificates. Adding this new option will allow us to avoid situations like this in the future.

🧪 Testing

I tested these changes by running the script in a repository that had secrets in both the local state and remote state. I confirmed that the changes worked as expected.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated
  to reflect the changes in this PR.
• All new and existing tests pass.