feat: add script to copy stores and uploads to a new space

[travis]

There are many ways a user might lose control of a space. Because we can't fake the crypto our system is built upon, the simplest solution to this is to have them create a new space that they do control and then ask us to copy the contents of the old space into the new.

Of course this doesn't require copying bits around - we just need to update some indices in DynamoDB. This script finds all entries in the store and upload tables for a space and creates new entries for each of those items in the new space. This should result in the new space being functionally identical to the old

This is a somewhat sensitive operation - we should only do this when we trust the customer a great deal - the contents of a particular space may be sensitive and this is a potential attack vector to discover them.

This has not been tested extensively, though I have run it in my development AWS env and it seems to work - we should do some validation that using this results in a new space that is functionally identical to the old.

@alanshaw particularly interested in your thoughts on whether this will mess up billing at all?

[seed-deploy]

View stack outputs

• pr392-w3infra-BillingDbStack

  Name	Value
  customerTableName	pr392-w3infra-customer
  spaceDiffTableName	pr392-w3infra-space-diff
  spaceSnapshotTableName	pr392-w3infra-space-snapshot
  usageTable	pr392-w3infra-usage

• pr392-w3infra-BillingStack

  Name	Value
  ApiEndpoint	https://wcna1z8xyg.execute-api.us-east-2.amazonaws.com
  billingCronHandlerURL	https://mmerh6kycub5ek7s2hwn7ofo7u0rrqxw.lambda-url.us-east-2.on.aws/
  CustomDomain	https://pr392.billing.web3.storage

• pr392-w3infra-CarparkStack

  Name	Value
  BucketName	carpark-pr392-0
  Region	us-east-2

• pr392-w3infra-RoundaboutStack

  Name	Value
  ApiEndpoint	https://ltgeehtd5a.execute-api.us-east-2.amazonaws.com
  CustomDomain	https://pr392.roundabout.web3.storage

• pr392-w3infra-UcanInvocationStack

  Name	Value
  invocationBucketName	invocation-store-pr392-0
  taskBucketName	task-store-pr392-0
  workflowBucketName	workflow-store-pr392-0

• pr392-w3infra-UploadApiStack

  Name	Value
  ApiEndpoint	https://mldk9ku9f9.execute-api.us-east-2.amazonaws.com
  CustomDomain	https://pr392.up.web3.storage

• pr392-w3infra-BusStack

• pr392-w3infra-FilecoinStack

• pr392-w3infra-ReplicatorStack

• pr392-w3infra-UcanFirehoseStack

• pr392-w3infra-UploadDbStack

[travis]

ok this is in good shape - my one remaining concern is how this will interact with billing - @hannahhoward maybe you have some insight since you've been in that code in the past few days?

[juliangruber]

ok this is in good shape - my one remaining concern is how this will interact with billing - @hannahhoward maybe you have some insight since you've been in that code in the past few days?

I was wondering about this as well, and was thinking that capabilities would need to be removed from the old account? But then I was wondering who pays for a file, if there are multiple accounts with access?

[travis]

closing to reclaim IAM roles