Refactor Terraform prod GitHub Actions workflows

[briancaffey]

The GitHub Actions for Terraform and other IaC tools should use the following pattern:

• terraform init + plan
• manual review (using environment set on the job)
• terraform apply

We can use artifacts to pass the terraform plan file available from the init + plan job to the apply job

This has already been successfully implemented for the Terraform prod base create/update and prod base destroy workflows. Here's an example:

The other Terraform workflows need to be updated using the same pattern:

• [x] prod base create/update

• [x] prod base destroy

• [x] prod app create/update

• [x] prod app destroy

• [ ] ad hoc base create/update

• [ ] ad hoc base destroy

• [ ] ad hoc app create/update

• [ ] ad hoc app destroy

Some links and issues:

• the actions/upload-artifact / actions/download-artifact actions do not preserve the permissions of the files, so executable permissions need to be set manually using chmod
• I set the working-directory default for run, but this does not apply to the artifact jobs, so artifacts need to be set relative to the root of the repo (not relative to the root of the default working directory) see this issue for more
• I'm following the recommendations from the document Running Terraform in Automation from the Terraform docs, which recommends artifacting not only the tfplan file, but also the .terraform directory. This allows us to run terraform init only once in our workflow.

cc @codyfletcher