ci: Validate and apply OpenTofu config via pipelines
Setup GitLab CI to build an OCI image with OpenTofu and other useful utilities, use that image to validate with tofu validate, and finally if manually activated from a protected commit on the default branch run tofu apply to update deployment-prep.
Bug: T372498