Bump aws-actions/configure-aws-credentials from v3 to v6 in incubator's Terraform workflows

### Overview

We need to move `aws-actions/configure-aws-credentials` off `@v3` in incubator's two Terraform workflows, because v3 runs on **Node 16** — a runtime GitHub removed from its runners, making these the most out-of-date action pins in the org. Bumping to `@v6` is the only version that lands on Node 24 and clears the deprecation outright.

### Action Items

- [ ] Read the two caveats under Resources/Instructions before starting. Merging this PR triggers a real `terraform apply` against the production AWS account, which is not true of most workflow-file changes.
- [ ] In `.github/workflows/terraform-plan.yaml`, change `uses: aws-actions/configure-aws-credentials@v3` to `@v6` (line 34 when written; find it by the `uses: aws-actions/configure-aws-credentials` line if it has drifted).
- [ ] In `.github/workflows/terraform-apply.yaml`, make the same change (line 34 when written; same fallback).
- [ ] Change nothing else in either file. The three inputs in use — `role-to-assume`, `role-session-name`, `aws-region` — are all unchanged across v3→v6, and their names and values stay exactly as they are. In particular do not touch the `permissions: id-token: write` blocks; OIDC still works the same way.
- [ ] Open the PR. Because both workflows filter on `paths: ['**/*.tf', '**/*.yaml']` and the workflow files are themselves `.yaml`, **the PR will trigger the `Terraform plan (OIDC)` job against your branch** — so the new pin gets exercised before anything merges. Do not merge until that job has run.
- [ ] Confirm the plan job's "configure aws credentials" step **succeeded** — this is the actual test that v6's OIDC role assumption works. If it fails to assume `incubator-tf-plan`, stop and report on this issue rather than trying other versions.
- [ ] Confirm the posted Terraform plan reports **no resource changes**. This PR touches no `.tf` files, so any proposed create/update/destroy means something else has drifted and must be resolved before merge — do not merge a non-empty plan.
- [ ] **After the PR merges**, open the Actions tab and confirm the `Terraform apply (OIDC)` run triggered by the merge **succeeded**, and that its apply made no resource changes. The merge to `main` fires this automatically. This step cannot be done from the branch and is the only place the apply path's credentials get verified — the PR only ever exercises the plan role.
- [ ] **After the PR merges**, comment on this issue with links to the plan run and the apply run, so the verification is on the record.

### Resources/Instructions

**Files to change** (both in `hackforla/incubator`, branch `main`):

- `.github/workflows/terraform-plan.yaml`
- `.github/workflows/terraform-apply.yaml`

**Why v6 and not v4.** Version-to-runtime mapping, read from each tag's `action.yml`:

| Tag | Node runtime |
|---|---|
| v3 | node16 (currently pinned here) |
| v4 | node20 (deprecated) |
| v5 | node20 (deprecated) |
| v6 | **node24** |

Stopping at v4 would only reach the same deprecated Node 20 that the rest of the org's action-bump work is trying to get off, so it is not worth a second PR later. v6 is the first release that clears it.

**The two breaking changes crossed, and why neither affects us:**

- **v5.0.0** changed how invalid boolean inputs are handled. Neither workflow passes a boolean input — only `role-to-assume`, `role-session-name` and `aws-region`, all strings — so this is a no-op here.
- **v6.0.0** is the Node 24 bump itself, which requires GitHub Actions runner v2.327.1 or later. Both jobs use `runs-on: ubuntu-latest` (GitHub-hosted), which is well past that, so no runner change is needed.

**Caveat 1 — merging runs a production apply.** `terraform-apply.yaml` triggers on push to `main` with `paths: ['**/*.tf', '**/*.yaml']`. Because this PR edits `.yaml` files, merging it **will** start a `terraform apply` against AWS account `035866691871`. That is why the empty-plan check above is a hard gate rather than a formality.

**Caveat 2 — devops-security is not a working reference for this.** `hackforla/devops-security` already pins `@v4` and it may look like a template to copy, but it authenticates with static `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` and has no `id-token: write` permission, whereas incubator uses OIDC role assumption. Nothing in the org currently runs this action at v6 on OIDC, so the plan-job check is a genuine test, not a rubber stamp.

**Out of scope, deliberately:** devops-security's own two `@v4` pins are on the deprecated Node 20 and need the same bump, but they are left out of this issue because that repo's workflows filter on `'**/*.tf'` only — a workflow-file-only PR there triggers neither plan nor apply, so the change cannot be verified the same way and needs its own approach.

**Related:** [incubator#156](https://github.com/hackforla/incubator/issues/156) / [incubator#157](https://github.com/hackforla/incubator/pull/157) removed `bastion.yml`, which held the other two out-of-date pins found in the same sweep. [devops#183](https://github.com/hackforla/devops/issues/183) covers `actions/checkout` across the org and explicitly excludes third-party actions like this one.

Read the two caveats and Resources/Instructions first. Update only the action pin in .github/workflows/terraform-plan.yaml and .github/workflows/terraform-apply.yaml, then open a PR and verify the plan job's credentials step succeeds with no Terraform resource changes. After merging, verify the apply run also succeeds with no changes and comment with both run links.

Written by the indexing model from the issue text.