All terraform configs have -euo pipefail (#2597)

Fixes #2441.

See this successful run in bazel-testing:

https://buildkite.com/bazel-testing/bazel-bazel/builds/9702#019dd4b0-7877-45e8-93c2-31f3201475e1

And see this example of a bad yml edit failing BazelCI in rules_android,
which was the pilot repo for prod pipefail:

https://buildkite.com/bazel/rules-android/builds/4450#019ddf2c-a635-4fde-a3a8-b8426ead7448