feat(opentofu): support Cloudflare API token

[xnoto]

Summary

• add optional CLOUDFLARE_API_TOKEN to the reusable OpenTofu workflow contract
• expose it only to the OpenTofu Plan and OpenTofu Apply steps
• document opt-in caller secret mapping for Cloudflare consumers

Validation

• reviewed the committed patch: 19 additive lines across the reusable workflow and README
• confirmed the fork-safe test job has no Cloudflare secret mapping
• confirmed existing triggers, permissions, AWS/GCP authentication, SSH setup, and Namecheap behavior are unchanged
• GitHub Actions checks pending

Security

• the token is declared optional and is never written to output, artifacts, or PR comments
• plan output redaction already redacts token-bearing lines

No merge or workflow dispatch performed.

[github-actions]

Shared workflows CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed