AWS/IAM/S3: setup public-read bucket, permissioned write

- [x] [Public bucket](https://s3.console.aws.amazon.com/s3/buckets/deptoolkit-public?region=eu-central-1&tab=objects)
- [ ] S3-write-only IAM role