tf-plan/tf-apply: support a pre-step that fetches a token-broker token for the provider #152

What: tf-plan.yaml and tf-apply.yaml accept no secrets and have no hook to run a step before Terraform that exports an env var. tf_pre_run runs inside the dflook action, so it cannot make a token from DND-IT/tamci/actions/token available as GITHUB_TOKEN to the provider.

Where: .github/workflows/tf-plan.yaml, .github/workflows/tf-apply.yaml (v4.3.2).

Why it matters: stacks that use the integrations/github provider (for example DND-IT/.github-private, which manages the org) need a short-lived GitHub App token from the token broker. Today they have to copy their own plan/apply workflow instead of using the shared ones.

Suggested fix: optional inputs gh_token_broker_url, gh_token_broker_identity, gh_token_broker_scope. When set, run DND-IT/tamci/actions/token before init and export the token as GITHUB_TOKEN for the Terraform steps.