ci: adopt tctest's pinned tooling, workflow hardening, and release signing; go 1.26.6

[katbyte]

Ports katbyte/tctest#123, katbyte/tctest#125, katbyte/tctest#128, katbyte/tctest#129, and katbyte/tctest#133 to terrafmt, plus a few repo-specific changes.

Dependencies (deps: copy in diff from my forks)

• moves the andreyvit-diff and diffmatchpatch forks in-tree under lib/diff/, dropping the external fork modules from go.mod/vendor

Pinned dev tooling & linters (tctest#123)

• .tools/go.mod pins golangci-lint, actionlint, and gofumpt; make builds them into .tools/bin (single source of truth for make and CI, dependabot keeps them bumped — quarterly, since tools should move slowly)
• custom golangci binary (golangci-with-modules) compiles in the azproviderlint module plugin; AZG general-Go rules enabled
• new actionlint, yamllint, shellcheck make targets + workflows (with actionlint problem matcher for inline annotations); check-all runs everything
• revive enabled (enable-all with justified opt-outs); new-linter findings fixed throughout, lib/diff/diffmatchpatch/ excluded from revive to stay diff-able against upstream go-diff
• azurerm-style workflow naming (pr-* prefixes, Title Case names); README badges/dev docs updated

Workflow hardening (tctest#125)

• all GitHub-owned actions pinned by commit hash with version comments
• CodeQL gets top-level contents: read; release contents: write scoped to the goreleaser job only
• pr-depscheck also triggers on .tools/** and verifies .tools tidy + the golangci version match with .custom-gcl.yml

SECURITY.md (tctest#128)

• scope rewritten for terrafmt: crafted markdown/Go input causing crashes, hangs, or out-of-target writes

Signed releases & provenance (tctest#129 + #133)

• cosign keyless-signs checksums.txt into a v3 sigstore bundle (checksums.txt.sigstore.json) — lands with the cosign v3 --bundle format directly, skipping the broken .sig/.pem intermediate that bit tctest v1.3.2
• GitHub artifact attestations via actions/attest-build-provenance (subject-checksums); verify with gh attestation verify <file> -R katbyte/terrafmt
• SLSA Build L3 provenance from the tag-pinned slsa-github-generator reusable workflow (it verifies its own ref and rejects hash pins)

go 1.26.6

• .go-version / go directives bumped to match tctest; unlocks AZG002's default new(expr) suggestion and the go 1.26 errors.AsType modernize rewrite in cli/flags.go

Verification

• make check-all green: build, tests (-race), lint (0 issues), actionlint, yamllint, shellcheck, depscheck
• release signing exercised end-to-end locally: full goreleaser snapshot with cosign v3.1.3 and a test key — bundle written, tracked as a signature artifact, cosign verify-blob --bundle passes; SLSA generator and attest action inputs verified against the pinned refs
• the identical signing config already shipped tctest v1.3.3 (checksums.txt.sigstore.json + multiple.intoto.jsonl on the release)

Notes:

• one deliberate //nolint:azproviderlint in blockreader.go: AZG006's inline suggestion would move astutil.Apply past the LineCount read that observes its side effects (its autofix broke TestCmdFmtStdinVerbose; worth a look in azproviderlint itself)