Define specific IAM roles and policies

[troyraen]

Partially addresses #52
Questions for Michael, Ross, and Google 20%ers:

What permissions/roles should we assign to allUsers (everyone on the internet), within our production project?
Specific questions:

• Viewer role. Should everyone be able to see all of our resources?
• An starter/example file is at: broker/iam/policy_examples/production_project.yaml

Background:

IAM "roles" are a collection of permissions that can be assigned to a user.
The basic process of setting permissions is to define a role, and then bind together 1) the role, 2) a user, 3) a resource (an individual resource or the entire project).

This PR:

• Starts an "iam" directory and some yaml files that define custom roles and policies for our projects. We can add permissions to these roles, and add more roles, as we go.
• Adds a student developer role and updates the docs about how to use it
• Starts a public user role
• Starts policies for production and testing projects

To Do

• Add files that define some basic roles (public user, student developer)
  • Fill out the student developer role with permissions. (I am working with Aaron and Chris to figure out what they need. - Note to self: copy developer-role permissions from console into yaml file.)
• Add files that define the policy for each project (production and testing). A policy is a collection of bindings (role, user, resource). These files are examples, and are not currently set on our projects.
• Add a REAME with instructions for adding/updating roles and changing the policy (including instructions for onboarding a new developer).
• Update the docs.
  • This is done, but move it to the onboarding branch: Move the Initial Setup instructions to a new section (Initial Setup), update with instructions for developers joining Pitt-Google, and add instructions for Pitt-Google managers onboarding new developers.

Future PRs:

• Create a developer role(s) for people in the category of Pitt-IT folks and Google 20%-ers
• Fill out the public user role with permissions. May consider setting only on specific resources, rather than the whole project.
• Update the GCP setup script to define these roles and set the appropriate policy. This will require that we think carefully about each resource, and we will probably need to define more roles.