chore: add CI, pre-commit, dependabot, and bump provider versions

[jtroup]

what

• Add .github/workflows/ci.yml: GitHub Actions CI workflow running
  pre-commit checks (terraform fmt/validate/tflint, actionlint,
  zizmor, codespell) on push and PR to main. All permissions scoped
  to minimum required; action SHAs are pinned.
• Add .github/dependabot.yaml: monthly grouped Dependabot updates
  for GitHub Actions with a 7-day cooldown and chore commit prefix.
• Add .pre-commit-config.yaml: hooks for terraform fmt/validate/
  tflint, actionlint, zizmor, and codespell. All revs are pinned to
  exact SHAs with frozen version comments.
• Add .tool-versions: pins just 1.40.0, terraform 1.13.5,
  tflint v0.61.0, uv 0.8.14 for use by CI and local dev.
• Add justfile: format (terraform fmt -recursive) and lint
  (uvx prek run --all-files) recipes.
• Update terraform/provider.tf: add explicit terraform block with
  required_version >= 1.13.5 and version constraints for aws (> 6.0),
  azurerm (> 4.0), and random (~> 3.0).
• Update terraform/.terraform.lock.hcl: bump aws 4.44.0 → 6.39.0,
  azurerm 3.64.0 → 4.67.0, random 3.5.1 → 3.8.1.

why

The repo lacked automated linting, dependency updates, and pinned tool
versions. Adding CI enforces consistent formatting and security checks
on every PR. Dependabot keeps Actions dependencies current without
manual effort. Provider version constraints and lock file updates bring
the Terraform configuration in line with current major versions.

testing

CI workflow runs on this PR and exercises the full pre-commit hook suite
against the changed files.

docs

No docs needed.

---

🤖 Generated with Claude Code