ci(pre-commit): tflint --init hits GitHub anonymous rate limit; pass GITHUB_TOKEN to authenticate plugin downloads #564

Summary

The terraform_tflint pre-commit hook runs tflint --init which pulls plugin tarballs (e.g. tflint-ruleset-azurerm v0.27.0) from api.github.com/repos/terraform-linters/... unauthenticated, hitting the 60-requests-per-hour anonymous rate limit per runner IP. When this trips, the pre-commit job fails with:

Failed to install a plugin; Failed to fetch GitHub releases:
GET https://api.github.com/repos/terraform-linters/tflint-ruleset-azurerm/releases/tags/v0.27.0:
403 API rate limit exceeded for 52.186.174.153.
[rate reset in 17m33s]

Observed on run 26160016057 for PR #560; a manual rerun later passed (rate window reset). Will recur arbitrarily as more PRs land same hour on the same NAT IP range.

Suggested fix

Pass GITHUB_TOKEN to tflint --init so it authenticates against the GitHub API (5000/hr limit, per-token). tflint reads it from the GITHUB_TOKEN env var natively. Easiest insertion point: the pre-commit job in .github/workflows/pre-commit.yml already has secrets.GITHUB_TOKEN available — add an env: block on the Run pre-commit step:

- name: Run pre-commit
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: pre-commit run --all-files

The hook itself doesn't need editing; tflint picks up the env var.

Acceptance criteria

• Run pre-commit step in .github/workflows/pre-commit.yml (or equivalent) exposes GITHUB_TOKEN to the environment.
• Three consecutive pre-commit runs in the same hour (across separate PRs) all complete without a tflint rate-limit failure.

Cross-references

• Hook: .pre-commit-config.yaml terraform_tflint entry
• Workflow: .github/workflows/pre-commit.yml
• Related to the broader CI-supply-chain hygiene work (issue sec(ci): GitHub Actions use mutable version tags instead of SHA-pinned refs #439 SHA-pinned actions, etc.)