wo attrs can be null, but cannot traverse null

There were two existing tests for incorrect return values, which the
code still satisfied. While we can return paths _to_ null values which
are write-only, you cannot traverse a null value to a write-only path.

internal/configs/configschema/write_only.go

@@ -19,7 +19,11 @@ import (
 func (b *Block) WriteOnlyPaths(val cty.Value, basePath cty.Path) []cty.Path {
 	var ret []cty.Path
 
-	// We can mark attributes as write-only even if the value is null
+	// the value as a whole cannot be write-only, so nothing to return
+	if val.IsNull() || !val.IsKnown() {
+		return ret
+	}
+
 	for name, attrS := range b.Attributes {
 		if attrS.WriteOnly {
 			attrPath := slices.Concat(basePath, cty.GetAttrPath(name))
@@ -27,11 +31,6 @@ func (b *Block) WriteOnlyPaths(val cty.Value, basePath cty.Path) []cty.Path {
 		}
 	}
 
-	// If the value is null, no other marks are possible
-	if val.IsNull() {
-		return ret
-	}
-
 	// Extract paths for marks from nested attribute type values
 	for name, attrS := range b.Attributes {
 		// If the attribute has no nested type, or the nested type doesn't

internal/configs/configschema/write_only_test.go

@@ -115,15 +115,11 @@ func TestBlock_WriteOnlyPaths(t *testing.T) {
 	}{
 		"unknown value": {
 			cty.UnknownVal(schema.ImpliedType()),
-			[]cty.Path{
-				{cty.GetAttrStep{Name: "wo"}},
-			},
+			[]cty.Path{},
 		},
 		"null object": {
 			cty.NullVal(schema.ImpliedType()),
-			[]cty.Path{
-				{cty.GetAttrStep{Name: "wo"}},
-			},
+			[]cty.Path{},
 		},
 		"object with unknown attributes and blocks": {
 			cty.ObjectVal(map[string]cty.Value{