Use ephemeral resources for sensitive Terraform state

[markhobson]

Terraform 1.11 introduced ephemeral resources to avoid persisting sensitive data in the state. We should use this for all sensitive resources where possible, such as client secrets.

We will need to consider how this will effect consuming upstream projects that currently provide state as sensitive outputs, as they will need to use secrets instead. See:

• https://github.com/acteng/ate-database/issues/150

We also need to check whether any scripts rely on this state and update them accordingly.