scheduled-job: keep the Slack channel token out of state via ephemeral + write-only

[jwbron]

Summary

The scheduled-job module reads Slack__API_token_for_alertlib with a data "google_secret_manager_secret_version" to build each job's Slack notification channel. Terraform state stores the full data-source response, including secret_data, so the token value sits in every consumer's state and every saved plan file; this is how the token was exposed by the committed-tfplan incident (see Khan/actions#274 and the consumer migrations).

Change

The channel stays fully Terraform-managed; the leak is fixed with the ephemeral/write-only mechanism (https://developer.hashicorp.com/terraform/language/manage-sensitive-data/ephemeral):

• the token is read with ephemeral "google_secret_manager_secret_version" (never persisted to state or plans), and
• written to the channel via the write-only sensitive_labels.auth_token_wo + auth_token_wo_version arguments, added to google_monitoring_notification_channel in provider 7.19.0.

Rotation becomes explicit: after adding a new secret version, bump the new slack_token_rotation variable; the next apply re-reads the latest version and rewrites the channel token. (The old data-source design also only picked up new versions on the next plan, so nothing is lost; the bump makes the cutover reviewable.)

An earlier revision of this PR added a notification_channel_ids input for pre-created channels; that is dropped in favor of keeping channel management in Terraform.

Requirements and rollout

• Terraform >= 1.11 (write-only arguments) and hashicorp/google >= 7.19.0; the module's required_providers now enforces both.
• Suggest releasing as scheduled-job-v0.4.0.
• Consumer follow-ups (culture-cron, beep-boop, internal-webserver; five jobs total, all currently embedding the token in state): bump the module pin, and bump the google provider pin from 7.8.0 to >= 7.19.0 in the two stacks that pin exactly (no committed lock files, so that is the whole change). The adoption plan should show the channel's sensitive labels updating in place; after apply plus a state refresh, the token value is gone from live state.
• Rotating the alertlib token (rotation runbook item Improve scheduled function module: replace versioning with hash-based naming and add retry configuration #4) is still required regardless, since historical plan files already leaked it; after consumers adopt this version, the runbook's Improve scheduled function module: replace versioning with hash-based naming and add retry configuration #4 mechanics change from "drift plan" to "bump slack_token_rotation in each repo".

[nathanjd]

An earlier revision of this PR added a notification_channel_ids input for pre-created channels; that is dropped in favor of keeping channel management in Terraform.

This seems like useless information.

[nathanjd]

Simple enough. Thanks!