Add validation to reject empty/whitespace-only password in vm module

[coderabbitai]

Summary

The password variable in modules/workloads/vm/variables.tf currently allows an empty string (""), which is treated as "set" in main.tf and can produce insecure/invalid cloud-init auth behavior. A validation block should be added to require null or a non-empty, non-whitespace string.

Proposed Fix

variable "password" {
  type        = string
  description = "Password for the default_user, injected via chpasswd.list. Only used when user_data is null. Leave null to disable password auth."
  default     = null
  sensitive   = true
  validation {
    condition     = var.password == null || length(trimspace(var.password)) > 0
    error_message = "password must be null or a non-empty string."
  }
}

References

• Flagged in PR Add password and ssh_authorized_keys to vm module #54 (Add password and ssh_authorized_keys to vm module #54 (comment))
• Requested by @HiranAdikari

[kavix]

Hi! I'd like to work on this issue. Could you please assign it to me?