terraform: rename the validate job to tf-validate

[cpitzi]

The terraform workflow added in #82 named its validation job validate, which
is also the job id in ci.yml. A job id becomes the check-run context, so the
repo published two check runs called validate — and validate is a required
context on main via fleet-ops/required-checks.json.

This was not a deadlock: the terraform job is gated on the changes detector and
skips on PRs that touch no terraform, and a skipped job counts as passing. But it
makes "did validate pass?" ambiguous for the ruleset, and a required context
that is not exactly the thing it appears to name is the specific failure mode
this repo's required-checks discipline exists to prevent (#27, #71).

Renames the job to tf-validate, leaving validate unambiguously ci.yml's. The
context that phase 2 will require is gate, which is unaffected and still
reports on every PR.

The gate job's references use needs['tf-validate'] rather than
needs.tf-validate: a hyphen in a context key parses as subtraction inside a
${{ }} expression.

Refs #81.