Assume IAM role rather than use hardcoded IAM user credentials for build job

[NoxHarmonium]

Using a role is best practice and gives the following benefits over an IAM user:

• We can set the role up so only Github (hopefully at the project/repo level) can assume it, hopefully not any random person who has stolen the credentials
• When the role is assumed, the credentials have an expiry so the impact is less when leaked
• The auditing is easier, a session name is provided when assuming the role so you know which system is doing the assuming

That's off the top of my head so it might not be 100% correct but I think the gist is correct.

See also:

https://github.com/aws-actions/configure-aws-credentials#credentials
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

[NoxHarmonium]

I made a start on this in my WIP branch for issue #43
https://github.com/agiledigital-labs/aws-durable-lambda/blob/issue-43-int-test/cf/ci-role.yaml