expand Roles and custom permissions support

[mattsb42-aws]

Currently, pipeformer will generate a least-privilege IAM Role for each category of thing that needs to do things (CodePipeline, CodeBuild, etc).

There are cases where these roles will need to be given additional, custom, permissions. We need to provide a way of specifying this.

We should also look into separating roles more granularly, so that, for example, a deployment CodeBuild project could be given access to deployment credentials without also giving that access to a test CodeBuild project.

[mattsb42-aws]

Closing down project: #52