Validate the terraform rules on PR with an action

[offbyone]

### Tasks
- [ ] Create a readonly role for planning
- [ ] https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/
- [ ] add a workflow to take advantage of it that just runs `terraform plan`