It's a breaking change due to a known oversight in the 3.x -> 4.x
migration.
https://github.com/cloudflare/terraform-provider-cloudflare/issues/2286
To resolve you can either:
1. Manually update the state file with the new resource name
2. Remove the resources from state, perform the upgrade and then
reimport the resources back into the state
3. (What I did, but you'll have downtime) Comment out the tunnel
resources, apply, bump the version to v4, uncomment, then apply again
to recreate the resources
