ci: strengthen pull request quality gates

[lweberru]

Summary

• add OpenTofu format and backend-free validation checks for pull requests
• run plan-based configuration tests with a STACKIT service-account secret
• move live STACKIT flavor validation to a scheduled or manual workflow
• remove the unreliable diagram auto-generation workflow

Required repository configuration

• Add the repository Actions secret STACKIT_SERVICE_ACCOUNT_KEY with the complete service-account-key JSON before merging.
• After this workflow has run once, require Format, Validate, Configuration Tests, and TFLint in the branch protection rule for main.

Validation

• tofu -chdir=src fmt -check -diff -recursive
• tofu -chdir=src validate -no-color
• YAML workflow parsing

TFLint was not installed locally; GitHub Actions runs the pinned version.