[ColeJordan-mobilise]

Context

This PR turns on Airbyte in the QA environment. Airbyte copies the Postgres database to BigQuery.

The shared Airbyte module and the ChangeRequests sync config are already on main (PR #709). This PR only sets the QA flags.

Changes proposed in this pull request

• Sets airbyte_enabled to true in qa.tfvars.json. This creates the Airbyte connection and the stream update job.
• Sets connection_status to active in qa.tfvars.json. The connection syncs every 15 minutes.
• pg_airbyte_enabled is already true in QA, so Postgres does not restart for write-ahead logging.
• The five AIRBYTE-* secrets are now in the QA infrastructure Key Vault.

Guidance to review

Run the Terraform plan for QA with the image that QA runs now:

TF_VAR_worker_docker_image=ghcr.io/dfe-digital/check-performance-data-worker:20da6b7bbb1a67987f39a6809b55ec142f0292ba \
  make qa terraform-plan DOCKER_IMAGE_TAG=20da6b7bbb1a67987f39a6809b55ec142f0292ba

The plan gives 20 to add, 2 to change, 2 to destroy.

• Add: the Airbyte source, destination and connection, the BigQuery dataset and IAM roles, the database setup job, and the .NET stream update job.
• Replace: the application config map and secret. They get new names because of the new Airbyte settings.
• Change in place: the web and worker deployments, to use the new config map and secret. QA web and worker pods restart.

How it was checked

• make qa terraform-plan succeeds with the command and plan above.
• The same module works in the review app (PR 2997-airbyte-review #709): the sync succeeds and the policy tags are applied.

Link to Trello card

https://trello.com/c/KrX6D2se/2997-enable-airbyte-in-service-cypmd

Checklist

• Attach to Trello card
• Rebased main
• Cleaned commit history
• Terraform apply and Airbyte sync checked in QA