Update the IAM roles for the new billing permissions

[alexwlchan]

A while back AWS changed their permissions model for some billing-related tasks, and they've been yelling us about them ever since. We used the deprecated IAM permissions in two places:

• the standard billing role in every account
• the CloudHealth role we create for D&T monitoring

These two deprecations have been fixed in the following ways:

• the standard billing role is gone; we haven't used it in the years it existed and it's unnecessary maintenance drag
• the CloudHealth role has been updated with the new policies from D&T