v0.5.39: chore: Upgrade c7n-left to 0.3.39 (#86)

[ENG-8511](https://stacklet.atlassian.net/browse/ENG-8511)

Release PR for 0.5.39. Picks up the c7n-left release that fixes
unresolved `for_each` values
when the collection contains a module output reference.

### what

Upgrades c7n-left from 0.3.38 to 0.3.39, which brings c7n 0.9.53,
tfparse 0.6.22 and
python-hcl2 8.1.4, and bumps the package version to 0.5.39.

The boto3/botocore pins move from 1.43.78 to 1.43.103. As with the last
release, this is
required: c7n 0.9.53 pins `boto3==1.43.103`. The lockfile refresh also
pulls in minor
transitive and development updates.

python-hcl2 jumps a major version (4.3.5 to 8.1.4). It's pinned by
c7n-left and not
imported by sinistral directly.

### why

tfparse 0.6.22 fixes `each.value.<attr>` resolution when a `for_each`
collection contains a
module output reference. Previously the `for_each` didn't expand at all:
the scan saw a
single bare `aws_sqs_queue.x` with attributes like `tags` left as an
unresolved
`each.value.tags` marker. Policies then evaluated the marker instead of
the real value.
That produced false positives on compliant resources and reported
findings against the
wrong address.

It also tracks references from resources to `data` source attributes.

Upstream: https://github.com/cloud-custodian/tfparse/issues/283,
https://github.com/cloud-custodian/tfparse/issues/277 and
https://github.com/cloud-custodian/tfparse/pull/285

### testing

Lint and the test suite pass.

Adds a regression test (`test_submit_run_foreach_module_output`) with a
fixture whose
`for_each` mixes a compliant entry tagged via a module output and a
static entry missing
the required tag. Only the static entry should be reported:

| c7n-left | scan result |
| --- | --- |
| 0.3.38 | one finding on bare `aws_sqs_queue.x`, tags
`{"__attribute__": "each.value.tags", ...}` (test fails) |
| 0.3.39 | one finding on `aws_sqs_queue.x["untagged"]`, tags `{"Team":
"platform"}` (test passes) |

### docs

Release notes updated.

Note for reviewers: merging this does not publish anything. The
`v0.5.39` tag push is
what triggers the release workflow, and CI does not run on tag pushes,
so this PR is the
only gate.

[ENG-8511]:
https://stacklet.atlassian.net/browse/ENG-8511?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>