feat(workflows): Onboarding STACKIT Workflows

[c-thiel]

Adds Terraform support for STACKIT Workflows (Apache Airflow 3 as a service):

  resources:    stackit_workflows_instance, stackit_workflows_dag_bundle
  data sources: stackit_workflows_instance, stackit_workflows_instances,
                stackit_workflows_dag_bundle, stackit_workflows_dag_bundles,
                stackit_workflows_provider_options

All seven surfaces are gated behind the workflows experiment flag.

Notes for reviewers:

• The workflows Go SDK is not yet on a published tag; this PR uses a replace-directive in go.mod pointing at the bot-generated branch. This is per the dev-tools team's request to enable an early review pass. The replace will be dropped once the SDK release lands.
• dag_bundle list/get endpoints currently return 403 in prod for service-account-authenticated callers. The server-side fix is merged upstream and awaiting deploy; acceptance tests against those endpoints will only pass once that ships.
• The Workflows team recently split DAG bundles out of the instance Create payload into a separate /dag-bundles resource. Two follow-up items are still in flight and are not provider bugs:
  • The new /dag-bundles list/get endpoints currently return 403 for
    service-account callers in production. The fix is merged upstream
    and awaiting deploy; acceptance tests against those endpoints will
    pass once it ships.
  • The instance helm chart still unconditionally provisions an
    ExternalSecret for the DAG-bundle git credentials, which means an
    Airflow 3 instance created without a bundle can't reach active.
    The team is working on this; in the meantime a follow-up provider
    PR will inline the bundles back onto the instance Create payload
    (which the API already supports) to side-step it.

Description

relates to #1234

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Examples were added / adjusted (see examples/ directory)
• Docs are up-to-date: make generate-docs (will be checked by CI)
• Unit tests got implemented or updated
• Acceptance tests got implemented or updated (see e.g. here)
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)