ci: fetch terraform from artifactapi instead of dnf install

dnf install reads metadata for every enabled repo and downloads the
vendored terraform RPM on every pipeline run. Fetch the pinned upstream
zip from the artifactapi hashicorp-releases remote instead, matching the
vault pattern in terraform-vault and terraform-artifactapi.

- Replace dnf install terraform with a pinned curl of the terraform
  1.15.0 zip (same version as the vendored RPM) from the artifactapi
  hashicorp-releases remote, extracted to /usr/local/bin.

.gitea/workflows/build.yaml

@@ -28,6 +28,7 @@ jobs:
       - name: Run Terraform Plan
         env:
           VAULT_ROLEID: ${{ secrets.TERRAFORM_INCUS_VAULT_ROLEID }}
+          TERRAFORM_VERSION: "1.15.0"
         run: |
-          dnf install terraform -y
+          curl -fsSL -o /tmp/terraform.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/terraform.zip /tmp/ && install -m0755 /tmp/terraform /usr/local/bin/terraform && rm -f /tmp/terraform.zip /tmp/terraform /tmp/LICENSE.txt
           make plan

.gitea/workflows/deploy.yaml

@@ -22,6 +22,7 @@ jobs:
       - name: Run Terraform Apply
         env:
           VAULT_ROLEID: ${{ secrets.TERRAFORM_INCUS_VAULT_ROLEID }}
+          TERRAFORM_VERSION: "1.15.0"
         run: |
-          dnf install terraform -y
+          curl -fsSL -o /tmp/terraform.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/terraform.zip /tmp/ && install -m0755 /tmp/terraform /usr/local/bin/terraform && rm -f /tmp/terraform.zip /tmp/terraform /tmp/LICENSE.txt
           make apply

Makefile

@@ -46,7 +46,7 @@ init:
 
 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false
+	terragrunt run --all --parallelism 4 --non-interactive plan
 
 apply: init
 	@$(call vault_env) && \