fix(misconf): skip rewriting expr if attr is nil

[nikpivkin]

The current implementation tries to rewrite the expression (expr) of an attribute without checking whether the attribute itself exists. We need to skip such attributes.

Discussed in #9112

[Keralin]

Hi! I can confirm this panic occurs in Trivy 0.64.0 with complex Terraform configurations. This is a regression - the same configuration works perfectly in 0.63.0.

🔍 Context & Environment

• Affected version: 0.64.0 (panic)
• Working version: 0.63.0 (no issues)
• Project type: Complex Terraform project with multiple modules and IAM policies
• Command: trivy conf --exit-code 1 --misconfig-scanners=terraform --skip-dirs "**/.terraform" --tf-exclude-downloaded-modules ./

got this stack trace:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xeef485]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/iac/terraform.(*Attribute).RewriteExpr(...)
    /home/runner/work/trivy/trivy/pkg/iac/terraform/attribute.go:837
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws/iam.ParsePolicyFromAttr(0x0?, 0x0?, {0xc0058084c0?, 0x0?, 0x0?})
    /home/runner/work/trivy/trivy/pkg/iac/adapters/terraform/aws/iam/convert.go:20 +0x25
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws/iam.parsePolicy(_, {_, _, _})
    /home/runner/work/trivy/trivy/pkg/iac/adapters/terraform/aws/iam/policies.go:36 +0x6fe

The panic occurs with IAM policy documents containing dynamic references:

data "aws_iam_policy_document" "example" {
  statement {
    resources = ["arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:*"]
  }
}

🚨 Important Note

• Simple isolated examples with this pattern do not reproduce the panic
• The issue appears when analyzing complex projects with multiple modules and dependencies
• This suggests the panic is context-dependent and related to how Trivy processes module relationships
• Workaround: Temporary downgrade to 0.63.0 resolves the issue

The panic is consistently reproducible in our CI/CD environment with containerized Trivy 0.64.0, but isolated examples don't trigger it. This suggests it's related to complex module evaluation or specific project structures.

Thanks for working on this fix! Let me know if you need access to a more complex test case or additional debugging information.