Add in-script IAM role creation for each training job.

Make the IAM role configurable in config (and then created just-in-time as Lambda is launched) for what they may need from it, rather than ask that it be set up ahead of time. Can give some preset IAM options for things like S3 read/S3 write/EC2 tag updates/EC2 termination so user gives a couple keywords in the config and the script auto-generates the necessary IAM roles on the fly.

Training config will need to be updated such that an existing IAM role can be used, otherwise a new one is auto-created.