Restrict permission for github runner's AWS role

[kislerdm]

Tech debt collected during execution of #35, it's a potential security threat:

resource "aws_iam_role_policy_attachment" "admin" {
  # FIXME: grant admin right on exceptional basis
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
  role       = aws_iam_role.github_actions.arn
}