fix: restrict access to AWS S3 bucket using OAI

[nicholaschiang]

We're hosting our static build/ assets with:

• An AWS S3 bucket that anyone can read
• CloudFront uses that S3 bucket as it's origin
• Route 53 has alias records from *.tutorbook.app and tutorbook.app pointing to that CloudFront distribution

See #255 for more info on how that migration went.

We need to restrict access to that S3 bucket while still enabling CloudFront to access our static files. See Amazon's documentation for how to get that done.