Pass assumed role credentials to CodeBuild build

[aidansteele]

Right now the actions operate with the role assigned to the CodeBuild project. This isn't the end of the world, but I would like to experiment with the idea of having the Fargate task assume a role and then pass it to CodeBuild as environment variables. Thoughts:

• Obviously needs to be encrypted. As it's sensitive, maybe it should wait on the improvements in Lock down KMS-encrypted data #3.
• Then the IAM role for CodeBuild only needs kms:Decrypt and the CloudWatch logs permissions. VPC ones too.
• When assuming the role, we can pass in a wealth of context as role session tags and the role session name. Things like
  • Repository
  • Workflow
  • Job name
  • "Actor" (who triggered it)
  • Branch
  • Commit SHA