Save terraform outputs to `guardian/outputs` branch

### TL;DR

Guardian apply should optionally store outputs to a locked-down branch named `guardian/outputs`.

### Detailed design

Why store outputs:
* Far more convenient to reference/link to (can link to a particular line)
* Don't have to remember which PR last applied changes to a particular entrypoint (the most up to date outputs are always in the branch)
* Stored outputs can be used to implement new features (abc generate templates using outputs as inputs)

Implementation:
* After a successful terraform apply the changed outputs should be committed to the `guardian/outputs` branch. ([terraform outputs](https://developer.hashicorp.com/terraform/cli/commands/output))
* the path to the outputs file should match the path to the tf entrypoint
* The commit should be pushed directly to the branch.
* The `guardian/outputs` branch should have branch protection to ensure no one has rights to commit to it besides the GitHub bot.

Risks
* Technically anyone could create a github action in a PR and use it to commit/modify the outputs branch. Mitigation: It should be documented that this should be used for non-production/non-critical paths. Additionally, any reference to outputs in code should be locked by hash to prevent changes to head breaking things.
* Terraform outputs can store sensitive details. Mitigation: This should be documented and any output that is sensitive should be marked as sensitive. We should also not specify `-json` or `-raw` so that terraform will not ignore `sensitive` attributes.

### Alternatives considered

1. Store the outputs in a GCS bucket. Why not: worse user experience
2. Store the outputs in the main branch. Why not: CLA blocks on github bot committing the code

### Additional information

_No response_

Look at the terraform apply command flow in the codebase, likely in a CLI or GitHub Action handler. Find where outputs are captured after a successful apply. Need to implement committing and pushing these outputs to a specific branch with a file path matching the tf entrypoint. Check existing branch protection and bot authentication setup. 'Done' means outputs are auto-committed to the protected branch after each apply.

Escrito por el modelo de indexación a partir del texto del issue.