feat: Add option to extend allowed buckets (for read) for Rift Compute role

[eshiferax]

For S3 tecton data sources (i.e. FileConfig BatchSource) in the same account as the dataplane, users currently need to manually edit their tecton-rift-compute role in order to give the jobs access to read those buckets

(if the source bucket is in a different account, they can get access with an s3 bucket policy + existing policy statement that already allows reads for buckets in separate accounts)

We should provide an option for this (additional read permissions for tecton-rift-compute) to be added via terraform to avoid drift / risk of removing their changes if they need to pull in updates or re-apply.

Adding new variable additional_s3_read_access_buckets (list of bucket names) here to support this.

Testing

1. Tested with an internal cluster without setting this variable. No changes.
2. Tested with an internal cluster setting additional_s3_read_access_buckets == [tst-tecton-access] Resulted in:

  # module.rift.aws_iam_policy.additional_s3_read_access[0] will be created
  + resource "aws_iam_policy" "additional_s3_read_access" {
      + arn         = (known after apply)
      + id          = (known after apply)
      + name        = "tecton-additional-s3-read-access"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:ListBucket"
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::tst-tecton-access",
                        ]
                    },
                  + {
                      + Action   = [
                          + "s3:GetObject",
                          + "s3:GetObjectversion",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::tst-tecton-access/*",
                        ]
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # module.rift.aws_iam_role_policy_attachment.rift_compute_policies["additional_s3_read_access"] will be created
  + resource "aws_iam_role_policy_attachment" "rift_compute_policies" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "tecton-rift-compute"
    }

Plan: 2 to add, 0 to change, 0 to destroy.