Summary

Fixes critical YANG choice constraint violation in AAA dot1x/enable authentication
configuration that caused state/reality drift and device configuration failures.

Problems Fixed

Problem 1: YANG Choice Constraint Violation

When configuring dot1x authentication with custom RADIUS/TACACS+ groups:

Module Input:

module "iosxe" {
  source = "./terraform-iosxe-nac-iosxe"

  # ... device config ...

  dot1xs = [
    {
      name    = "wired_auth"
      methods = ["local", "sw_radius_group"]
    }
  ]
}

Expected Device CLI:

  aaa authentication dot1x wired_auth local group sw_radius_group

Actual Device CLI (before fix):

  aaa authentication dot1x wired_auth cache false cache false cache false cache false

Terraform showed configuration applied successfully in state, but device had incorrect
authentication methods configured.

Problem 2: Array Index Logic Error

Module was incorrectly checking methods[3] when evaluating methods[1], causing
out-of-bounds errors and incorrect group name retrieval for authentication method lists.

Root Causes

1. YANG Choice Constraint Violation

Module was violating YANG choice constraint by setting multiple mutually-exclusive options
simultaneously.

Provider Resource Arguments (before fix):

  resource "iosxe_aaa_authentication" "aaa_authentication" {
    dot1x = [
      {
        name      = "wired_auth"
        a1_local  = true
        a1_cache  = "false"              # Setting unused choice option
        a2_group  = "sw_radius_group"
        a2_cache  = "false"              # Setting unused choice option
      }
    ]
  }

From Cisco-IOS-XE-aaa.yang:

  container a2-config {
    choice dot1x-auth {      // Only ONE can be set
      leaf group { type union { type string; } }
      leaf local { type empty; }
      leaf cache { type union { type string; } }
      leaf radius { type empty; }
    }
  }

Issue: Module set unused choice options to false → Terraform coerced to string "false" →
Provider serialized ALL values → RESTCONF applied last value (cache false) and ignored the
intended value (group).

2. Incorrect Array Indexing

BEFORE (iosxe_aaa.tf):

  a2_group = try(!contains(["local", "cache", "radius"], try(e.methods[1], ...)), false) 
             ? try(e.methods[3], ...) : null  # Checking [3] when [1] fails

AFTER (iosxe_aaa.tf):

  a2_group = !contains(["local", "radius"], try(e.methods[1].method, ...))
             ? try(e.methods[1].method, ...) : null  # Checking correct index

Verification

Device CLI (after fix):

  aaa authentication dot1x wired_auth local group sw_radius_group