Terraform: honor the Application Gateway certificate toggle

## Issue

The Terraform Application Gateway module does not fully honor enableAppGatewayCertificate.

When certificate support is disabled, Terraform should not require or read a PFX file, create a Key Vault certificate secret/role assignment, or configure an SSL certificate on Application Gateway. Currently, only the ports and listener are conditional; the PFX is still read and the certificate resources are still created. In addition, the root Terraform deployment does not expose or forward this toggle.

## Expected behavior:

- enableAppGatewayCertificate = false creates an HTTP-only Application Gateway.
- No PFX file is required in that mode.
- No certificate secret or Key Vault role assignment is created.
- No SSL certificate is attached to the Application Gateway.

## Proposed fix:

- Add and forward a root-level enableAppGatewayCertificate variable.
- Make PFX loading, certificate creation, Key Vault secret references, and sslCertificates conditional.
- Make the root Application Gateway module conditional on deployHelloWorldSample, matching Bicep behavior.
- Add a validation case using enableAppGatewayCertificate = false and a nonexistent PFX path.

Start with the Terraform Application Gateway module and the root Terraform deployment, tracing enableAppGatewayCertificate through the module inputs and certificate-related resources. Add the requested validation case with the toggle disabled and a nonexistent PFX path. Done means the disabled mode deploys HTTP-only without reading the PFX, creating certificate resources or role assignments, or attaching an SSL certificate.

Written by the indexing model from the issue text.