Allow readonly roles to lock Terraform state files

[AP-Hunt]

What problem does this pull request solve?

Previously the permission was granted through a policy giving DynamoDB permissions. We must now grant very limited permissions in S3 instead.

Note

This will need applying by hand in each environment

Things to consider when reviewing

• Ensure that you consider the wider context.
• Does it work when run on your machine?
• Is it clear what the code is doing?
• Do the commit messages explain why the changes were made?
• Are there all the unit tests needed?
• Has all relevant documentation been updated?

Reminders

If you've made changes to the deployer role (files in modules/deployer-access):

• Remember to run make <environment> forms/account apply on the relevant environments (dev, staging, user-research, and/or prod)
• Check the #govuk-forms-deployment-notifications Slack channel to ensure the apply-forms-terraform-<environment> pipelines have run successfully

[sarahseewhy]

Thank you! 🚀