CCAP-137: Add OpenTofu backend for staging

[jamesiarmes]

🔗 Jira ticket

CCAP-137

✍️ Description

Added a backend configuration for the staging environment.
Set up GitHub Actions for scanning and deployment.

Note: This does not complete CCAP-137, but I felt it would be easier to review this as a separate piece

📷 Design reference

🧪 Testing instructions

• Make sure you have OpenTofu installed (brew install opentofu)
• Clone the repo and checkout this pull request
• Navigate to the "staging" config (cd tofu/config/staging)
• Follow the steps in the README to initialize the configuration (no need to plan or apply at this time)
• Run tofu plan and verify that there are no expected changes

✅ Completion tasks

• Added relevant tests
• Meets acceptance criteria

[github-actions]

Plan output

module.backend.data.aws_caller_identity.identity: Reading...
module.backend.data.aws_partition.current: Reading...
module.backend.data.aws_partition.current: Read complete after 0s [id=aws]
module.backend.aws_s3_bucket.tfstate: Refreshing state... [id=illinois-getchildcare-staging-tfstate]
module.backend.data.aws_caller_identity.identity: Read complete after 0s [id=891377151751]
module.backend.aws_s3_bucket_public_access_block.tfstate: Refreshing state... [id=illinois-getchildcare-staging-tfstate]
module.backend.aws_s3_bucket_policy.tfstate: Refreshing state... [id=illinois-getchildcare-staging-tfstate]
module.backend.aws_s3_bucket_logging.tfstate: Refreshing state... [id=illinois-getchildcare-staging-tfstate]
module.backend.aws_s3_bucket_versioning.tfstate: Refreshing state... [id=illinois-getchildcare-staging-tfstate]
module.backend.aws_kms_key.backend: Refreshing state... [id=e12d42f7-5c01-4df2-8f70-8647f8e51d7e]
module.backend.aws_kms_alias.backend: Refreshing state... [id=alias/illinois-getchildcare/staging/backend]
module.backend.aws_s3_bucket_server_side_encryption_configuration.tfstate: Refreshing state... [id=illinois-getchildcare-staging-tfstate]
module.backend.aws_dynamodb_table.tfstate_lock: Refreshing state... [id=tfstate]

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.

[enyia21]

I have one quick correction to suggest. the -o flag doesn't work for me. -out does.