Bump configure-aws-credentials to v6 and dflook/terraform-* to v3 in the Terraform workflows

### Overview

We need to bump `aws-actions/configure-aws-credentials` from `@v4` to `@v6` and `dflook/terraform-plan`/`dflook/terraform-apply` from `@v1` to `@v3` in both Terraform workflows, because `configure-aws-credentials@v4` runs on the deprecated Node 20 and the `dflook` pins are four releases behind, including a fix for `terraform-apply` wrongly aborting on a plan that contains both imports and warnings.

### Action Items

**`aws-actions/configure-aws-credentials` — `@v4` to `@v6`, 2 lines:**

- [ ] `.github/workflows/terraform-plan.yaml:25` and `.github/workflows/terraform-apply.yaml:25`.
- [ ] **Go to v6, not v4-for-parity and not v5.** Reading `action.yml` at each tag: **v3 = node16, v4 = node20, v5 = node20, v6 = node24**. Only v6 clears the Node 20 deprecation. This repo was previously described as the "good" state that incubator's `@v3` should be brought up to — that was wrong, `@v4` here is deprecated too.
- [ ] Note this is the **opposite call** from `actions/checkout` in hackforla/devops#183, which deliberately stops at v5 rather than going current. The two look inconsistent and are not: for `checkout` an intermediate version already reaches Node 24, and for this action nothing below v6 does.

**`dflook/terraform-plan` and `dflook/terraform-apply` — `@v1` to `@v3`, 2 lines:**

- [ ] `terraform-plan.yaml:32` (`dflook/terraform-plan@v1`) and `terraform-apply.yaml:32` (`dflook/terraform-apply@v1`).
- [ ] `@v1` is a **floating tag**, so this is less stale than it looks — it resolves to v1.49.0 (2025-05-29), not the 2021 release. Latest is v3.0.0 (2026-07-18). The honest framing is four missed releases, not "two majors behind".
- [ ] **The Node 20 deprecation does not apply to these two.** Both are Docker actions (`runs: using: docker`), so no JS runtime is involved. That is why going straight to current is fine here.
- [ ] Checked before this ticket was written, so you do not have to: the only input removed across both majors is the deprecated `var:` input (v2.0.0), and neither workflow uses it — they pass only `path`, `backend_config_file` and `auto_approve`, all still present at v3.0.0. The real risk is the debian 11 → 12 → 13 base-image bump.

**Out of scope — do not change these here:**

- [ ] `actions/checkout@v4` at line 23 of **both** files belongs to hackforla/devops#183. Leave it alone. If hackforla/devops#183's devops-security PR has already merged, rebase; if it has not, whoever merges second rebases. Same two files, adjacent lines.

**Verification — read this before opening the PR, it is the awkward part:**

- [ ] **Both workflows filter on `paths: ['**/*.tf']` only**, so a PR that changes only `.github/workflows/*.yaml` triggers **neither** plan nor apply and shows no checks at all. That is expected, not a failure — and it means this change is not self-testing the way the equivalent incubator work (hackforla/incubator#158, hackforla/incubator#159) was.
- [ ] To exercise the plan job in the same PR, include a **no-op change to a `.tf` file** (a comment line). Treat an **empty plan as a hard gate**: if the plan shows any resource change, stop and raise it rather than merging.
- [ ] **After the PR merges**, `terraform-apply.yaml` runs a real `terraform apply` against AWS on push to `main`. Confirm that run succeeds and carries no "Node.js 20 is deprecated" annotation. This cannot be checked from the branch.

### Resources/Instructions

- Files (default branch is `main`): `.github/workflows/terraform-plan.yaml`, `.github/workflows/terraform-apply.yaml`
- Line numbers accurate 2026-08-27 and will drift — locate each pin by its `uses:` line rather than by position.
- **Coordination with the OIDC work.** There is an unticketed plan to move both workflows off static AWS credentials onto OIDC role assumption, which rewrites `configure-aws-credentials` — the very line this ticket bumps. If that work starts before this is picked up, fold this in and close this issue as covered rather than editing the same lines twice.
- Related: hackforla/devops#183 (`actions/checkout` in the same files), hackforla/incubator#158 (same `configure-aws-credentials` bump, already ticketed), hackforla/incubator#159 (same `dflook` bump, already ticketed).

Start by reading .github/workflows/terraform-plan.yaml and .github/workflows/terraform-apply.yaml, locating the relevant uses: lines rather than relying on line numbers. Check the paths filter and coordinate with the related OIDC and checkout work before editing. Done means only the specified action pins change, a no-op .tf change produces an empty plan, and the post-merge apply succeeds without a Node.js 20 deprecation annotation.

Rédigé par le modèle d'indexation à partir du texte de l'issue.