Proposal: port forwarding via SSH tunnel

proposal: port forwarding via SSH tunnel

I'd like to start adding port forwarding via SSH tunnels to terraform.

This is useful when you want to use terraform with systems which are only accessible via a jump host, ie. company internal systems.

Right now terraform already ships with a bunch of providers which might need to
talk to internal systems (e.g. postgres/ mysql/ influxdb/…).

The status quo is to create a SSH tunnel beforehand, or, in cases where the
entire infrastructure is created from scratch, to be split terraform scripts into multiple stages with glue code outside.
E.g. one might setup a private cluster with a jump host, open an
SSH tunnel via bash, and then run a differen terraform script using the newly created
tunnel to access private systems, all wrapped in a single `setup.sh` script.

Assuming that the SSH tunnel is required for all resources of a given provider,
I suggest adding connection settings to the terraform providers as well, like this:

```
provider "consul" {
address = "localhost:80"
datacenter = "nyc1"

# run "ssh -L localhost:80:demo.consul.io:80" for any resources of this provider
connection {
user = "private-user"
host = "private.jump-host.io"

forward {
remote_host = "demo.consul.io"
remote_port = 80
local_port = 80
}
}
}

# Access a key in Consul; consul is only available via SSH tunnel
resource "consul_keys" "app" {
key {
name = "ami"
path = "service/app/launch_ami"
default = "ami-1234"
}
}
```

Looking forward to any feedback before I head of adding something like this to terraform… ;)

Related: #4442, #4775

Start with the proposal and related issues #4442 and #4775; the issue names no implementation files, tests, or entry points. Clarify the provider-level connection and forwarding design, then define acceptance around configuring an SSH tunnel that lets all resources for a provider reach systems accessible through a jump host.

Written by the indexing model from the issue text.