Add iam_only variable and remove import blocks

[ale210]

Closes #196.

Removes all 18 import blocks, since every target is already in state and they break runs in any other account.

Adds iam_only (default true), which skips the Hack for LA-specific CloudTrail trails and buckets in cloudtrail.tf. Both workflows set iam_only = false, and the trails and buckets carry prevent_destroy, so a run against our account that forgets the variable fails at plan time instead of destroying them.

Also replaces the hardcoded ManageAccessKeys ARN with a resource reference, and documents the flag in CONTRIBUTING.md.

Local plans against the live state (1.16.2, -lock=false):

• -var iam_only=false: 0 to add, 0 to change, 0 to destroy. The CloudTrail resources show only as moved to [0].
• default: fails with Instance cannot be destroyed on both buckets.

The CI plan on this PR should read 0 / 0 / 0.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars
With variables: iam_only = false

Plan: 0 to add, 0 to change, 0 to destroy, 11 to move.

Terraform will perform the following actions:

  # aws_cloudtrail.management_events has moved to aws_cloudtrail.management_events[0]
    resource "aws_cloudtrail" "management_events" {
        id                            = "arn:aws:cloudtrail:us-west-2:035866691871:trail/management-events"
        name                          = "management-events"
        tags                          = {}
#        (16 unchanged attributes hidden)

#        (1 unchanged block hidden)
    }

  # aws_cloudtrail.tf_backend_logs has moved to aws_cloudtrail.tf_backend_logs[0]
    resource "aws_cloudtrail" "tf_backend_logs" {
        id                            = "arn:aws:cloudtrail:us-west-2:035866691871:trail/devops-security-tf-backend-logs"
        name                          = "devops-security-tf-backend-logs"
        tags                          = {
            "project" = "devops-security"
        }
#        (16 unchanged attributes hidden)

#        (1 unchanged block hidden)
    }

  # aws_s3_bucket.management_events has moved to aws_s3_bucket.management_events[0]
    resource "aws_s3_bucket" "management_events" {
        id                          = "aws-cloudtrail-logs-035866691871-6539ef03"
        tags                        = {}
#        (15 unchanged attributes hidden)

#        (3 unchanged blocks hidden)
    }

  # aws_s3_bucket.tf_backend_logs has moved to aws_s3_bucket.tf_backend_logs[0]
    resource "aws_s3_bucket" "tf_backend_logs" {
        id                          = "aws-cloudtrail-logs-035866691871-4b8654bf"
        tags                        = {}
#        (15 unchanged attributes hidden)

#        (3 unchanged blocks hidden)
    }

  # aws_s3_bucket_ownership_controls.tf_backend_logs has moved to aws_s3_bucket_ownership_controls.tf_backend_logs[0]
    resource "aws_s3_bucket_ownership_controls" "tf_backend_logs" {
        id     = "aws-cloudtrail-logs-035866691871-4b8654bf"
#        (2 unchanged attributes hidden)

#        (1 unchanged block hidden)
    }

  # aws_s3_bucket_policy.management_events has moved to aws_s3_bucket_policy.management_events[0]
    resource "aws_s3_bucket_policy" "management_events" {
        id     = "aws-cloudtrail-logs-035866691871-6539ef03"
#        (3 unchanged attributes hidden)
    }

  # aws_s3_bucket_policy.tf_backend_logs has moved to aws_s3_bucket_policy.tf_backend_logs[0]
    resource "aws_s3_bucket_policy" "tf_backend_logs" {
        id     = "aws-cloudtrail-logs-035866691871-4b8654bf"
#        (3 unchanged attributes hidden)
    }

  # aws_s3_bucket_public_access_block.management_events has moved to aws_s3_bucket_public_access_block.management_events[0]
    resource "aws_s3_bucket_public_access_block" "management_events" {
        id                      = "aws-cloudtrail-logs-035866691871-6539ef03"
#        (6 unchanged attributes hidden)
    }

  # aws_s3_bucket_public_access_block.tf_backend_logs has moved to aws_s3_bucket_public_access_block.tf_backend_logs[0]
    resource "aws_s3_bucket_public_access_block" "tf_backend_logs" {
        id                      = "aws-cloudtrail-logs-035866691871-4b8654bf"
#        (6 unchanged attributes hidden)
    }

  # aws_s3_bucket_server_side_encryption_configuration.management_events has moved to aws_s3_bucket_server_side_encryption_configuration.management_events[0]
    resource "aws_s3_bucket_server_side_encryption_configuration" "management_events" {
        id                    = "aws-cloudtrail-logs-035866691871-6539ef03"
#        (3 unchanged attributes hidden)

#        (1 unchanged block hidden)
    }

  # aws_s3_bucket_server_side_encryption_configuration.tf_backend_logs has moved to aws_s3_bucket_server_side_encryption_configuration.tf_backend_logs[0]
    resource "aws_s3_bucket_server_side_encryption_configuration" "tf_backend_logs" {
        id                    = "aws-cloudtrail-logs-035866691871-4b8654bf"
#        (3 unchanged attributes hidden)

#        (1 unchanged block hidden)
    }

Plan: 0 to add, 0 to change, 0 to destroy.

✅ Plan applied in Apply Terraform changes on merge #47