Problem

Currently, the Xeol scanner does not detect End-of-Life (EOL) Terraform providers or binaries. As infrastructure-as-code matures, catching deprecated Terraform providers (e.g., AWS provider v4.x) hidden deep in environment sub-folders is critical to preventing breaking changes and maintaining security compliance.
Because the underlying syft dependency does not natively parse .terraform.lock.hcl files by default, Terraform infrastructure is currently being silently skipped during filesystem scans.

Proposed Solution

Add native end-to-end scanning support for Terraform within the xeol CLI. This would require:

1. Lockfile Discovery: The ability to walk directories, discover .terraform.lock.hcl files, and parse the pinned provider versions inside them.
2. Terraform Matcher: A matcher capable of evaluating these HashiCorp providers against the EOL database.
3. Database Upstream: Updating the xeol-db pipeline to ingest Terraform lifecycles (e.g., via endoflife.date and major provider deprecation schedules) so the client has accurate lifecycle data to match against.

Expected Behavior

When running xeol dir:. on a repository containing Terraform lockfiles, it should flag any outdated providers or binaries that have passed their EOL dates.