r/aws_elasticsearch_domain_policy: handle domain update propagation delays

This change adds logic to retry ValidationExceptions which indicate a domain change is in-progress. When a domain policy change immediately follows domain creation or modification, delays in propagation of the ACTIVE status can cause intermittent ValidationExceptions. These errors are now retried for a short interval (2 minutes), which should allow configurations pairing domain and domain policy resources to complete successfully on the first apply.

```console
% make testacc PKG=elasticsearch TESTS=TestAccElasticsearchDomainPolicy_
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.21.8 test ./internal/service/elasticsearch/... -v -count 1 -parallel 20 -run='TestAccElasticsearchDomainPolicy_'  -timeout 360m

--- PASS: TestAccElasticsearchDomainPolicy_basic (1956.43s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/elasticsearch      1962.012s
```

Author: jar-b

internal/service/elasticsearch/domain_policy.go

@@ -91,10 +91,16 @@ func resourceDomainPolicyUpsert(ctx context.Context, d *schema.ResourceData, met
 		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", policy, err)
 	}
 
-	_, err = conn.UpdateElasticsearchDomainConfigWithContext(ctx, &elasticsearch.UpdateElasticsearchDomainConfigInput{
-		DomainName:     aws.String(domainName),
-		AccessPolicies: aws.String(policy),
-	})
+	_, err = tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout,
+		func() (interface{}, error) {
+			return conn.UpdateElasticsearchDomainConfigWithContext(ctx, &elasticsearch.UpdateElasticsearchDomainConfigInput{
+				DomainName:     aws.String(domainName),
+				AccessPolicies: aws.String(policy),
+			})
+		},
+		elasticsearch.ErrCodeValidationException,
+		"A change/update is in progress",
+	)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting Elasticsearch Domain Policy (%s): %s", d.Id(), err)
 	}