ci: add protected Terraform plan and apply workflows

[lweberru]

Summary

• run an authenticated OpenTofu plan automatically for every same-repository pull request
• protect STACKIT credentials with CODEOWNER approval and disabled admin bypass
• allow GitHub repository variables to override the selected tfvars configuration
• publish an add/change/destroy/replace summary as a persistent PR comment
• add a manual, CODEOWNER-only Apply workflow for main
• block Apply plans containing deletes or replacements
• fail Apply closed until a persistent remote state backend is configured
• pin all actions in the sensitive workflows to immutable commit SHAs

Configuration

The default configuration is config/hub-and-spoke-prod-nonprod-firewall.tfvars. Repository variables and the protected environment secret have already been configured.

Testing

• workflow YAML syntax validated
• tofu fmt -check -recursive passed
• protected PR plan executed successfully
• Apply is intentionally not executed because the remote state backend is not configured yet

This PR is based on feat/multi-area-regional-hub-spoke because the selected tfvars file is introduced by #66.

[github-actions]

✅ Terraform Plan: Changes detected

Add	Change	Destroy	Replace
2	0	0	4

Configuration: src/config/hub-and-spoke-prod-nonprod-firewall.tfvars
Commit: aa6cc9a
Workflow run

[lweberru]

Closing this PR because the deployment verification workflow introduced by #71 and refined by #73, #74, #75, #76, and #77 has superseded its plan/apply approach. The merged workflow uses an isolated OIDC-backed plan/apply/destroy cycle and avoids the persistent PR/main apply path proposed here. The PR plan summary remains a potentially useful standalone feature, but should be reintroduced separately from current main and adapted to the OIDC model if still needed.