Purge Fastly cache when publishing rustup

We recently realized that the cache on Fastly is not purged when a new version of rustup is released.

rustup is distributed via static.rust-lang.org as part of the same Fastly services as the Rust releases. Ideally, we therefore only purge cached versions of rustup and don't purge the whole cache. We already do this for the Rust releases by setting surrogate keys that we can granularly purge.

Fastly's purge APIs require authentication. We can generate a token that is scoped to the service and only grants permissions to purge content. The token can be stored in the parameter store on AWS, similar to other tokens that we already use.

Tasks

• Set a surrogate key for requests to /rustup/*
• Create an authentication token for the release process and store it in SSM
• Extend sync-dist.py to purge the surrogate key