helper/schema: Online/Network/API validation

Depends on hashicorp/terraform#15895
Or it's probably better if it hashicorp/terraform#15895 is implemented first.

------

It is certainly undesirable to perform any "slow" validation which requires network access by default in `terraform validate`, but there's still value in having such validation.

It can be opt-in for `validate` command and it can also (more importantly) run as part of `plan`.

The implementation can be very much similar to `ValidateFunc`, except that the interface needs access to provider's `meta`.

Example use cases in AWS provider:

```go
"vpc_security_group_ids": {
Type: schema.TypeString,
Optional: true,
NetworkValidateFunc: func(k string, v, meta interface{}) (ws []string, es []error) {
if hasEc2Classic(meta.(*AWSClient).supportedplatforms) {
es = append(es, fmt.Errorf("Use security_groups (with SG names) in EC2 Classic-enabled region"))
return
}
return
},
},
"security_groups": {
Type: schema.TypeString,
Optional: true,
NetworkValidateFunc: func(k string, v, meta interface{}) (ws []string, es []error) {
if !hasEc2Classic(meta.(*AWSClient).supportedplatforms) {
es = append(es, fmt.Errorf("Use security_group_ids (with SG IDs) in VPC-enabled region"))
return
}
return
},
},
```

I'm not sure if `NetworkValidateFunc` is the best name, but this is rather a simple "reminder" rather than full-blown proposal with all answers.

Related: https://github.com/terraform-providers/terraform-provider-aws/pull/3897

Start in the helper/schema validation code and compare the existing ValidateFunc interface with the proposed provider-meta access. Review the dependency on hashicorp/terraform#15895 and the terraform validate and plan paths. Done means an agreed opt-in network validation design that can run during plan without making default validate perform network access.

Written by the indexing model from the issue text.