support for TF_LOG & friends

To track down a bug in an external data provider script, I needed to enable TF_LOG (well, TF_LOG_PROVIDER), but I wanted to set TF_LOG_PATH and have that added as an artifact rather than having that spewed to the console log. It seemed like it should be pretty straightforward to add to the jobs I've built on top of job-templates, except that I couldn't figure out a way to add to the existing artifact path, and had to overwrite it. Given that !reference doesn't work to just add list items from other artifact:paths lists, I just overwrote it completely (because I was just doing some one-time debugging, I didn't need to be able to pass the plan on to the apply job). Seems like doing this cleanly requires support from the templates.

One thing to note, though—because the existing artifact defaults to access: none and all artifacts from a job share the same access level (why?) support for artifacts_access would have to be introduced into job-templates so one could override that to access: developer or whatever.

Oh, and because my bug was causing the job to fail, I also needed to set artifacts:when: always, which might or might not have adverse effects on the plan artifact (on_failure, which would also be reasonable for this, certainly would).