Allow S3 policy to be specified in config

Adds an optional 'policy' field to the S3 configuration allowing specific
permissions to be specified. The default is 'public-read'.

Currently, all uploaded tiles are hard-coded with their permissions set to 'public-read'. This allows us to specify the S3 ACL policy for the tile set. Because the default is 'public-read' there is no effect on previously existing config files.