add restrict-resources-by-module-source.sentinel

[rberlind]

This adds a new restrict-resources-by-modules-source.sentinel poilcy that restricts resources of specific types to only be created in modules with sources in a given list. It used the tfconfig/v2 import and a new function, get_module_source(), that I added to the tfconfig-functions.sentinel module. There is a new MD file to describe that new function.

It also fixes an error in the recently added restrict-s3-bucket-policies.sentinel policy, replacing an occurrence of break with continue.

It also changes some comments in the MD file for tfconfig-functions.find_descendant_modules() to refer to module labels instead of names and fixes a broken link in that file.

And it makes a mior typographical change in aws-functions.sentinel to change num_segments -1 to num_segments-1.