CI tool-version drift detected

## CI tool-version drift report

Pinned CI linter/scanner tool versions that Dependabot does not track, compared against their upstream latest stable releases. Generated by `scripts/Check-ToolVersionDrift.sh` (see [ci-tool-versions.yml](../workflows/ci-tool-versions.yml)).

| Tool | Pinned | Latest | Status |
| --- | --- | --- | --- |
| ShellCheck | `0.11.0` | `0.11.0` | ✅ up to date |
| actionlint | `1.7.12` | `1.7.12` | ✅ up to date |
| gitleaks | `8.30.1` | `8.30.1` | ✅ up to date |
| PSScriptAnalyzer | `1.25.0` | `1.25.0` | ✅ up to date |
| markdownlint-cli2 | `0.23.2` | `0.23.2` | ✅ up to date |
| tflint | `0.64.0` | `0.64.0` | ✅ up to date |
| tflint azurerm ruleset | `0.32.0` | `0.32.0` | ✅ up to date |
| Terraform CLI | `1.16.0` | `1.16.2` | 🔴 **DRIFT** |

### 1 tool(s) behind — files to update

- **Terraform CLI**: `1.16.0` → `1.16.2`
- Files to update:
- .github/workflows/ci-terraform.yml (fmt + validate jobs)
- terraform.tf (required_version)

After bumping each version, keep the pinned copies in sync across every file listed above, then run `./scripts/Invoke-CIChecks.sh` locally before pushing.

---
_Generated by [ci-tool-versions.yml](https://github.com/Azure-Samples/azuresandbox/actions/runs/34824188200) on 2026-09-14 08:43 UTC. This issue is opened/updated/closed automatically; edits to the body may be overwritten on the next run._

Update the Terraform CLI version in .github/workflows/ci-terraform.yml for the fmt and validate jobs and in terraform.tf so both pinned copies match 1.16.2. Start by checking those entries, then run ./scripts/Invoke-CIChecks.sh locally; done means the versions are synchronized and the checks pass.

Written by the indexing model from the issue text.