Update infra docs to reflect recent terraform aws changes

[consideRatio]

In #3932 we stopped hardcoding user-sa k8s service account names and the creation of a single IAM Role that users of the k8s ServiceAccount is allowed to assume. Instead, its now for example possible to add another IAM role that users of another k8s ServiceAccount can assume, like admin-sa, which then can have different permissions.

Docs to update/write:

• how to (aws only atm) separate admin/non-admin users cloud permissions (terraform + basehub functionality involved)
• how to (aws only atm) provide bucket access, also as bucket_readonly_access, and not only bucket_admin_access