add temporary dinopark roles expiring january 1

[andrewkrug]

This adds two templates:

• 1 to infosec creating a cross account assumable role that can read IAM data.
• 1 to IAM allowing members of a group to assume the role created by the previous template.

Notes:

• role assumption requires MFA
• access will auto expire as per our working agreement 01012019