fix(terraform): handle empty key vault ip rules

[Mukeshkr-19]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Fixes #7384.

CKV_AZURE_189 incorrectly fails Azure Key Vault configurations where public network access is enabled but network_acls uses default_action = "Deny" with an explicitly empty ip_rules list.

Terraform can represent an empty ip_rules value as either a nested empty list or a normalized empty list depending on the processing path. The check previously treated the empty value as falsy and fell through to FAILED.

This change:

• recognizes an explicitly empty ip_rules list after normalization
• requires default_action = "Deny" for the new pass condition
• preserves existing behavior for missing, unresolved, and non-empty values
• adds regression coverage for both raw and normalized empty-list representations

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes