Document the aws provider default_tags block

[ale210]

Follow-up to #173, for #172.

The apply on #173's merge partially failed: all 17 IAM users got managed-by, but 7 resources (3 policies, 3 roles, 1 OIDC provider) were denied because the CI user's TerraformIAM policy granted iam:TagUser and none of iam:TagRole / iam:TagPolicy / iam:TagOpenIDConnectProvider. That policy is console-managed, not in this repo; it is now at v15 with the three actions added, so the denials are resolved.

Re-running the failed apply could not work: dflook/terraform-apply compares against the plan approved on the PR, and that plan (24 changes) no longer matches reality (7 changes) now that the users are tagged. Re-runs also replay the workflow file as it was at that commit, so they never picked up auto_approve.

This PR exists to trigger a fresh apply. The workflow's paths filter is '**/*.tf', so only a .tf change starts one — the comment added here is that change, and it records the three things about this block that are not obvious from reading it: why there is no region/profile, why the tag value differs from incubator's, and that IAM groups and policy attachments cannot carry the tag at all.

Expected plan: 0 to add, 7 to change, 0 to destroy, all tags_all.

After merge, verify with aws iam list-role-tags --role-name gha-incubator, which is the check #172 asks for.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 0 to add, 7 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # aws_iam_role.incubator_tf_apply will be updated in-place
!~  resource "aws_iam_role" "incubator_tf_apply" {
        id                    = "incubator-tf-apply"
        name                  = "incubator-tf-apply"
        tags                  = {}
!~      tags_all              = {
+           "managed-by" = "terraform-devops-security"
        }
#        (11 unchanged attributes hidden)
    }

  # aws_iam_role.incubator_tf_plan will be updated in-place
!~  resource "aws_iam_role" "incubator_tf_plan" {
        id                    = "incubator-tf-plan"
        name                  = "incubator-tf-plan"
        tags                  = {}
!~      tags_all              = {
+           "managed-by" = "terraform-devops-security"
        }
#        (11 unchanged attributes hidden)
    }

  # module.aws_custom_policies.aws_iam_policy.custom_policy["EnforceMFAForUsers"] will be updated in-place
!~  resource "aws_iam_policy" "custom_policy" {
        id               = "arn:aws:iam::035866691871:policy/EnforceMFAForUsers"
        name             = "EnforceMFAForUsers"
        tags             = {}
!~      tags_all         = {
+           "managed-by" = "terraform-devops-security"
        }
#        (7 unchanged attributes hidden)
    }

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesSupervisor"] will be updated in-place
!~  resource "aws_iam_policy" "custom_policy" {
        id               = "arn:aws:iam::035866691871:policy/IAMServicesSupervisor"
        name             = "IAMServicesSupervisor"
        tags             = {}
!~      tags_all         = {
+           "managed-by" = "terraform-devops-security"
        }
#        (7 unchanged attributes hidden)
    }

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IncubatorTfPlanSecretsRead"] will be updated in-place
!~  resource "aws_iam_policy" "custom_policy" {
        id               = "arn:aws:iam::035866691871:policy/IncubatorTfPlanSecretsRead"
        name             = "IncubatorTfPlanSecretsRead"
        tags             = {}
!~      tags_all         = {
+           "managed-by" = "terraform-devops-security"
        }
#        (7 unchanged attributes hidden)
    }

  # module.iam_oidc_gha_incubator.aws_iam_openid_connect_provider.github_actions will be updated in-place
!~  resource "aws_iam_openid_connect_provider" "github_actions" {
        id              = "arn:aws:iam::035866691871:oidc-provider/token.actions.githubusercontent.com"
        tags            = {}
!~      tags_all        = {
+           "managed-by" = "terraform-devops-security"
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_oidc_gha_incubator.aws_iam_role.github_actions_oidc will be updated in-place
!~  resource "aws_iam_role" "github_actions_oidc" {
        id                    = "gha-incubator"
        name                  = "gha-incubator"
        tags                  = {}
!~      tags_all              = {
+           "managed-by" = "terraform-devops-security"
        }
#        (11 unchanged attributes hidden)
    }

Plan: 0 to add, 7 to change, 0 to destroy.

✅ Plan applied in Apply Terraform changes on merge #40