Update some s3 permissions

[minrk]

• make user image public (needed for kbatch)
• make reference-data read-only for all users, like data lake
• deny bucket creation permissions to all s3 users (all documentation I can find suggests this is meant to be the default, but doesn't appear to be)
• update some wildcards in user policies because bucket operations are done on bucket-name while Object operations are on bucket-name/*