Update gh actions:

- aquasecurity/trivy-action v0.34.0
- harden-runner v2.14.2

Description:
This PR updates the bundled Terraform binary and related version pins
from 1.13.4 to 1.14.5 (base image, installer fallback, and CI/test
fixtures). Terraform is statically built with an embedded Go runtime.
Moving to 1.14.5 updates the embedded toolchain and is intended to
address Go stdlib CVEs reported by security scanning.

Notes:

- Change is version-only; no functional Coder logic changes.

- Backport-friendly: intended to be cherry-picked to release branches
after merge.

---------

Co-authored-by: Jakub Domeracki <[email protected]>
Co-authored-by: Dean Sheather <[email protected]>

Related [`internal#1281`](coder/internal#1281)

Cherry picks two pull-requests in `release/2.29`.

* #22048
* #21998
* #22210

Parent agents were re-using AuthInstanceID when spawning child agents.
This caused GetWorkspaceAgentByInstanceID to return the most recently
created sub agent instead of the parent when the parent tried to refetch
its own manifest.

Fix by not reusing AuthInstanceID for sub agents, and updating
GetWorkspaceAgentByInstanceID to filter them out entirely.

---

Cherry picked from 911d734

…meters (#22256)

Cherry-pick of 60e3ab7 from main.

Workspace created via mode=auto links now require explicit user
confirmation before provisioning. A warning dialog shows all prefilled
param.* values from the URL and blocks creation until the user clicks
`Confirm and Create`. Clicking `Cancel` falls back to the standard form
view.

### Breaking behavior change

Links using `mode=auto` (e.g., "Open in Coder" buttons) will no longer
silently create workspaces. Users will now see a consent dialog and must
explicitly confirm before the workspace is provisioned.

Original PR: #22011

Co-authored-by: Kacper Sawicki <[email protected]>
Co-authored-by: Jake Howell <[email protected]>