Rgjb te eli 422 add kms permissions to external role (#392)

* Added new kms policy for external write role

* Moved ref checkout to the top of deploy job

* Remove repeated code

Author: robbailiff2

.github/workflows/base-deploy.yml

@@ -84,25 +84,6 @@ jobs:
       contents: write
     environment: ${{ needs.metadata.outputs.environment }}
     steps:
-      - name: "Setup Terraform"
-        uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: ${{ needs.metadata.outputs.terraform_version }}
-
-      - name: "Install Poetry"
-        run: |
-          curl -sSL https://install.python-poetry.org | python3 -
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: "Set up Python"
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-          cache: 'poetry'
-
-      - name: "Install dependencies"
-        run: poetry install
-
       - name: "Checkout repository at ref"
         uses: actions/checkout@v5
         with: