ci: extend workflows with Terraform functionality

[JoshuaLicense]

Description

• Adds 2 GitHub OIDC assumable roles. Readonly role for pull_request events, and a more permissive role for applying Terraform that is available on push to the default branch.
• Adds an S3 and Dynamodb to handle state (& locking).
• Add CI workflows to plan Terraform and post the output to a pull request.

Before submitting (or marking as "ready for review")

• Does the pull request title follow the conventional commit specification?
• Have you performed a self-review of the code
• Have you have added tests that prove the fix or feature is effective and working
• Did you make sure to update any documentation relating to this change?

[github-actions]

Terraform plan for account: nonprod

Commit: 6206686

Plan summary

0 to add, 0 to change, 0 to destroy

---

Show full plan

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

[github-actions]

Terraform plan for environment: dev

Commit: 6206686

API version: be6a3c6
Selfserve version: be6a3c6
Internal version: be6a3c6

Plan summary

0 to add, 0 to change, 0 to destroy

---

Show full plan

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.