Enable assuming different AWS roles for different parts of the build

Twoliter currently does not provide any way to assume different AWS roles during different build phases. This can be rather annoying if you want to assume e.g. one role to fetch kits from a private ECR repository, and then use another one to interact with KMS for secureboot keys.

Start by tracing Twoliter's build phases and how AWS access is currently handled. Define how separate role assumptions would apply to fetching kits from a private ECR repository and interacting with KMS; done requires both phases to use their intended roles.

Written by the indexing model from the issue text.