ci: Split tofu plan and apply into separate jobs
Change the default workflow so that post-merge to main we run a tofu plan job that will log what OpenTofu expects to change in the
environment separately from the manual tofu apply job. This should
allow maintainers to see what is expected to change before they decide
to apply those changes.
Bug: T372498