Set-up OIDC for S3 and CDK deployments

[alexwilson]

I currently rely on AWS key for pushing files to S3, and now that I want to also add CDK deployments I'm very uncomfortable with generating (and remembering to) rotate keys.
There are many disadvantages to keys, amongst which is that they're available as environment variables for all tasks during builds, tests and deployments.

Instead I'd prefer to set-up OIDC and remove these secrets outright.