Use team roles, and group-policies instead of user policies.

The team roles are being added so that teams can access S3 from their instances
without needing to specify their credentials.

Groups are created for each team simply because group policies can be larger
than user policies and our team-specific policy list was getting too long.