Allow google_s3_mirror to read from staging

[richardTowers]

... as well as integration.

The idea here is to mirror from staging instead of integration, so that we can reduce the frequency that the integration databases are restored. See alphagov/govuk-helm-charts#2719 for more context.

Initially, we need to allow reading from both environments, otherwise we'll break the current mirroring from integration. There's probably no harm in it being able to read both in the long term, but strictly speaking it should only need staging once we've switched it over.

This produces no-changes plans in integration and production. In staging we have:

Terraform will perform the following actions:

  # aws_iam_policy.google-s3-mirror[0] will be created
  + resource "aws_iam_policy" "google-s3-mirror" {
      + arn         = (known after apply)
      + description = "Allows a Google Cloud Platform project to mirror S3 buckets."
      + id          = (known after apply)
      + name        = "google-s3-mirror"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:List*",
                          + "s3:Get*",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::govuk-staging-database-backups/*",
                          + "arn:aws:s3:::govuk-staging-database-backups",
                        ]
                      + Sid      = "GoogleReadBucket"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # aws_iam_role.google-s3-mirror[0] will be created
  + resource "aws_iam_role" "google-s3-mirror" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringEquals = {
                              + accounts.google.com:sub = "107768730699967087212"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "accounts.google.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "google-s3-mirror"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

  # aws_iam_role_policy_attachment.google-s3-mirror-access[0] will be created
  + resource "aws_iam_role_policy_attachment" "google-s3-mirror-access" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "google-s3-mirror"
    }

Plan: 3 to add, 0 to change, 0 to destroy.