Enable assuming different AWS roles for different parts of the build

[cbgbt]

Twoliter currently does not provide any way to assume different AWS roles during different build phases. This can be rather annoying if you want to assume e.g. one role to fetch kits from a private ECR repository, and then use another one to interact with KMS for secureboot keys.