Switch AWS credentials from a long-lived IAM user to short-lived role sessions

I'll also be removing the corresponding repository secrets. Both that and this commit are required to effect the switch for the workflows using our AWS Batch runtime, which is all of them except upload.yaml. That workflow will be switched solely by the removal of repository secrets, with the change to it here merely a cleanup.