Add a Terraform-based alternative to CP04/CP05 (environments, groups, identity)

[metjuperry]

Adds infra/ plus two new checkpoint scripts, CP04b/CP05b, as a declarative alternative to CP04/CP05's imperative txc/az calls — same outcome (Dev + Test Dataverse sandboxes, OIDC deployment identity), driven by Terraform instead.

What's in here

• infra/environments/terraform: Dev + Test Dataverse environments, audit settings, security-team membership, and CD application-user registration
• infra/groups/terraform: the environment group that holds Dev + Test — applied automatically by CP04b the first time it provisions the environments (not on later re-runs, since changing an existing environment's group is a real mutation of that resource, not something a routine re-run should trigger as a side effect)
• infra/identity/terraform: the Entra app registration, service principal, and GitHub OIDC federated credential used for CI/CD, applied by CP05b
• infra/tenant/terraform: tenant-wide settings, scaffold-only by design — deliberately not driven by any checkpoint, since auto-applying it would be unsafe in a tenant shared across multiple attendees/forks

Run CP04+CP05 (imperative) or CP04b+CP05b (Terraform), not a mix — CP05b verifies Terraform's local state already owns the Test environment before proceeding. Full details (scope, layout, local-state caveats, cross-tier wiring) in infra/README.md.

Validation

Ran the full lab checkpoint-by-checkpoint against a real tenant using this Terraform track end to end (CP01 → CP08) to shake this out, which is how the following got caught and fixed before this PR:

• terraform init failed immediately — CP04b/CP05b referenced .infra/..., but the actual directory is infra/... (no leading dot).
• terraform apply failed on the Test app-user record — test/config.yml shipped with the literal placeholder "TODO-CHANGE-ME" for deployment_principal_id, which is non-empty, so app-user.tf's create_app_user = deployment_principal_id != "" fired before a real principal existed, and Terraform tried (and failed) to parse the placeholder as a GUID.
• Dev/Test were always created ungrouped — groups/terraform was never invoked anywhere, even though the group it creates exists specifically to hold them. Now wired into CP04b as described above.
• terraform validate passes in all four root modules; groups/terraform and tenant/terraform (the two designed to apply standalone) both plan cleanly against a live tenant with no vars required, matching infra/README.md's claim.
• The environment-group fix was also verified live: a dry terraform plan confirmed environment_group_id is an in-place update on an existing environment (not a destroy/recreate) before applying it for real.