[ale210]

Fixes #208

Adds incubator's terraform-docs job to terraform-plan.yaml, copied verbatim, so the Terraform module READMEs are regenerated on every PR that changes a .tf file.

• Deletes the five hand-run .terraform.docs.yml configs. The job runs without a config, and terraform-docs would never auto-discover these files anyway because of how they are named.
• Moves each README's hand-written text above <!-- BEGIN_TF_DOCS -->, so inject mode doesn't overwrite it. The root README's Directory Structure list is rewritten: its file links pointed at module folders, and half the files were missing. aws-gha-oidc-providers gets its first README, with a heading.
• The READMEs are regenerated locally with terraform-docs v0.20.0, the version the action bundles, using the action's arguments. This PR changes no .tf file, so the new job will not run on it. A second local run changes nothing, so the job's first real run should have nothing to push. The regenerated tables also correct stale entries: users that have been removed, the missing CloudTrail lifecycle resources, and aws-groups' policy_arn type.
• CONTRIBUTING.md and the pre-work template no longer tell contributors to run terraform-docs by hand.

The squash-merge message source was switched to PR title/body beforehand, so the docs job's [skip ci] can't leak into the commit on main and skip the apply.

After merge: check that the commit on main has no [skip ci] and that Apply Terraform changes on merge ran.