aws hubs: consistent setup of cloud permissions and bucket envs

[consideRatio]

I saw that we had several hubs where buckets were setup in terraform, but not made available to hubs. This PR setups access to the buckets.

Does parts of whats needed for #3864 - looked at all AWS clusters' hubs.

• This PR hasn't verified access works, and for several hubs I think it won't work due to singleuser.cloudMetadata.blockWithIptables defaulting to false, for example for opensci's staging hub.
• This PR has used terraform as the source of truth if hubs should have access to buckets - so if a scratch bucket was defined for staging, then staging should have access to if for example. So, we could opt to instead delete the buckets from terraform as an alternative to setting up access to it.