fix(static-app): derive log group name statically

Using aws_lambda_function.oidc.logging_config[0].log_group as a
for_each key fails at plan time because it's an apply-time attribute.
Lambda always creates the log group at /aws/lambda/<function_name>, so
we can construct the path from local.prefix instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jnf

tofu/modules/static-app/local.tf

@@ -9,9 +9,7 @@ locals {
   file_dir   = "${path.module}/files"
   fqdn       = "${var.subdomain}.${var.domain}"
   lambda_dir = "${path.module}/lambda"
-  log_groups = [
-    aws_lambda_function.oidc.logging_config[0].log_group
-  ]
+  log_groups = toset(["/aws/lambda/${local.prefix}-oidc"])
   project            = "cfa-static-apps"
   prefix             = join("-", [local.project, var.environment])
   protected_prefixes = keys(local.apps)