Lock down security on bot repo to allow write access to contributors

[jakebolam]

Is your feature request related to a problem? Please describe.
Maintainers should have write access to all repos, they currently do not have write access to the bot (due to security concerns).

Describe the solution you'd like
Lock down CI to only inject AWS secrets on master pushes.
Lock down AWS credentials to have the minimum credentials required for deployment.

Additional context
We don't pass environment variables (Secrets) to forked builds. Which is how we can currently have users fork the repo, put up pull requests and run the test builds.

[jakebolam]

We have attempted this IAM config to no avail.

serverless/serverless#588 (comment)

Error messages from serverless deploy are fairly useless, the exact minimum resources required for deploy are unknown.