Terraform provider upgrades and repo hygiene

## Items

### 1. Plan azurerm provider upgrade (3.x → 4.x)

`terraform/providers.tf` pins `azurerm ~> 3.111.0`. Version 4.x is available with new features and deprecation removals. Plan and execute the upgrade, checking for breaking changes.

Also tighten the Terraform version constraint from `>= 1.5` to `>= 1.5, < 2.0` to prevent accidental use of a future major version with breaking changes.

### 2. Add consistent resource tagging

Resources across both `terraform/` and `terraform-hisec/` have inconsistent or missing tags. Define a standard set of tags (e.g., `ManagedBy`, `Environment`) via a `locals` block and apply across all resources.

### 3. Pin GitHub Actions to exact versions

Workflows in `.github/workflows/` use major version pins (`@v6`, `@v4`, `@v7`). Pin to exact versions (e.g., `@v6.0.0`) or commit SHAs for stronger supply-chain security.

### 4. Fix .gitignore pattern

`.gitignore` has `*.tfstate` which doesn't match `*.tfstate.backup` files. Change to `*.tfstate*`.