feat: add Cloudflare workload tunnels

[glitchedmob]

Creates separate account-scoped Cloudflare Tunnels for SGF Devs and OpenSGF so both accounts can route public applications into the SGF workload cluster.

• Configure explicit Cloudflare provider aliases and token inputs for both accounts.
• Create remotely managed tunnels with ACME HTTP-01 and HTTPS Traefik ingress rules for the managed SGF Devs and OpenSGF zones.
• Publish separate connector tokens to SGF SSM and expose both tunnel DNS targets.
• Wire the new token inputs into PR and main Terraform workflows and document the operational order.

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-vm-workloads/actions/runs/33265613458

Show summary

CHANGE	RESOURCE
add (6)	aws_ssm_parameter.cloudflare_opensgf_tunnel_token
	aws_ssm_parameter.cloudflare_sgfdevs_tunnel_token
	cloudflare_zero_trust_tunnel_cloudflared.opensgf_k3s
	cloudflare_zero_trust_tunnel_cloudflared.sgfdevs_k3s
	cloudflare_zero_trust_tunnel_cloudflared_config.opensgf_k3s
	cloudflare_zero_trust_tunnel_cloudflared_config.sgfdevs_k3s

CHANGE	OUTPUT
add (1)	cloudflare_tunnel_targets
update (1)	ssm_paths

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY