simplify s3 permissions a bit more

[minrk]

• remove ACLs on other than the allow-all-authenticated, as they are redundant with (and less effective) than user policies
• consolidate common policy (read access to public + deny bucket creation) to a variable we can reuse (less copy/paste to make new buckets)
• add test to exercise everyone's s3 permissions to make sure they are correct

@annefou this simplifies creating a new group/bucket because it only needs to create the user policy and the user policy only needs to specify the write permissions, as the read/deny permissions are shared through a variable

[annefou]

Nice! How gfts-track-reconstruction/jupyterhub/tofu/tests/test_permissions.py should be run? Do we need to run it manually after tofu apply or is it run automatically?

[minrk]

Yes, run pytest in the tofu directory after tofu apply