The read-modify-write pattern conditional requests guard is not specific to
one resource — every Terraform-managed resource has the same shape, so the
second consumer of this is a matter of when, not if. Deciding the entity-tag
quoting, the "*" form, the list form and the weak-validator rule once here
means an adopting resource inherits all of them instead of re-deriving each.
Only the derivation stays on the type, since only the type knows which of its
fields the representation covers.
IfMatch returns a nil-safe precondition rather than a slice of tags. If-Match
is defined in terms of the strong comparison function, so a weak validator can
never satisfy it — and a header carrying nothing but weak validators then
parses to an empty list, which the obvious call-site check reads as "no
precondition given" and lets the write through unguarded. That is precisely
the failure this is meant to prevent, and it is reachable by a proxy that
weakens an ETag in transit. An absent header is unconditional; a header that
was sent but carries nothing usable refuses.
Weak validators are dropped rather than unwrapped, for the same reason:
unwrapping one into a strong tag would quietly grant a match that the client's
own header said it could not have.
No handler uses this yet.
