Prepare restriction of AWS permissions for github workflows

[bogsi17]

We want to restrict the IAM role used by the Github workflows such that it can only be assumed by workflow runs from the main and release branches. This causes the problem that deployment workflows run from tags could not assume the role anymore.

To mitigate this issue and still allow deploying specific tags, this PR allows to specify the git tag that shall be deployed in a dedicated field. While the workflow can be run from main or release, this still allows to deploy a specific git tag. If no value is set, it defaults to the regular behaviour.

[misaka]

If we are running deploy-infrastructure with an image_tag, do we not also need to do the same thing with deploy-application?

Looking at the deploy-application workflow it appears to checkout the code and uses settings from TF. At a guess, even though it may be unlikely to diverge we probably still want to make sure that those values match whatever is on the branch we're deploying.

[bogsi17]

If we are running deploy-infrastructure with an image_tag, do we not also need to do the same thing with deploy-application?

Looking at the deploy-application workflow it appears to checkout the code and uses settings from TF. At a guess, even though it may be unlikely to diverge we probably still want to make sure that those values match whatever is on the branch we're deploying.

@misaka You're right, I will add it

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[misaka]

Looks good! We agreed we'd leave the new CodeQL warning alone for now, and address in a later PR. 👍