terraform-pipeline.yml: Split hidden jobs to a base template

Discussion in !78 (closed) has raised the point that currently the documentation comments at the head of the terraform-pipeline.yml template do not accurately reflect when the plan and apply jobs will be added to the pipeline. In particular, the terraform plan and terraform apply sections should be reworded to explain that the default jobs for the development, staging, and production environments will always be added to pipelines triggered for the default branch, irrespective of the CI_PIPELINE_SOURCE value.

It was also discussed that we should split this template into a "base" and a "paved path" template so that people can decide to create custom workflows more easily by simply importing the base template if required. This issue will also cover this task.