Set up S3 permissions scope for internal only resources

## Type of Issue

Select the type of issue:
- [ ] Bug report (to report a bug)
- [ ] Feature request (to request an additional feature)
- [x] Tracker (I am just using this as a tracker)
- [ ] Refactor request
- [ ] Documentation Ask

## Description

One way to do this is to tag objects as internal and give IAM users permissions to access. See

https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html

## Current Behavior

craftassist/pubr bucket is set to ACL public read.

## Checklist

- [ ] Create internal scope
- [ ] Authorize relevant IAM users
- [ ] Categorize documents
- [ ] Look into tagging models/dataset versions as `latest` and updating fetch/deploy scripts