ci: Split tofu plan and apply into separate jobs
Change the default workflow so that post-merge to main we run a tofu plan
job that will log what OpenTofu expects to change in the
environment separately from the manual tofu apply
job. This should
allow maintainers to see what is expected to change before they decide
to apply those changes.
Bug: T372498