Tammy wants to be able to reliably deploy the automation every time

The modules should pin the versions of *every* dependency including:

- Terraform provider
- Submodules

We generally follow this for submodules but not everywhere. Also, we don't pin the terraform providers to a specific version anywhere (at best we say >= X). We need to pin all of these versions.

To manage the maintenance for all those versions we need to also add a workflow that runs periodically and checks to see if there is a newer version of the submodule or provider, creates a PR, validates the updated versions, and performs an auto-merge if the test passes.