Add documentation on the permissions needed for EC2 deployments.

[rbvermaa]

E.g. provide a sample policy people can use to create an user and policy in the AWS console.

[yotann]

As a starting point, here's an access policy for EC2, IAM roles, and S3. I've tried to restrict it so it can only access NixOps-created resources which have the default charon-* resource names. The policy works for basic NixOps usage but probably not nixops backup or the other AWS resources NixOps can provision.

[pjones]

This is huge! Deploying to EC2 for the first time is super complicated. Having a policy would go a long way to making this easier.