Document required IAM policy for deploying

This is what I used for setting this up via Terraform, we should add this somewhere in a nice format:

data "aws_iam_policy_document" "github_api_deploy" {
  statement {
    actions = [
      "lambda:InvokeFunction",
      "lambda:UpdateFunctionCode",
      "lambda:UpdateFunctionConfiguration",
    ]

    resources = [data.aws_lambda_function.api_test.arn]
  }

  // Everything below here is only needed when NOT specifying --no-api-gateway

  statement {
    actions   = ["lambda:AddPermission"]
    resources = ["${data.aws_lambda_function.api_test.arn}:*"]
  }

  // This is only needed when NOT specifying --rest-api-id=
  statement {
    actions   = ["apigateway:GET"]
    resources = ["arn:aws:apigateway:eu-west-1::/restapis"]
  }

  statement {
    actions   = ["apigateway:PUT"]
    resources = [data.aws_api_gateway_rest_api.api_test.arn]
  }

  statement {
    actions   = ["apigateway:POST"]
    resources = ["${data.aws_api_gateway_rest_api.api_test.arn}/deployments"]
  }
}

Start by locating the repository's existing deployment or AWS documentation, since the issue does not name a target file or section. Add the supplied Terraform IAM policy in a clear format, preserving the notes about --no-api-gateway and --rest-api-id; done means deployers can identify the required permissions and when each is needed.