Create/remove roles for each team.

`aws TEAM` now will create a role for each team that permits associated EC2
instances to access the team's S3 resources. Likewise `aws-purge TEAM` will
remove these created roles.

Also, add convenience method `aws-update-all` for quickly updating the settings
for all the teams.