User buckets: Allow scoping permission granted to a specific prefix.

[jhkennedy]

Currently, we grant all permissions to the entire bucket; either:

Resource": "arn:aws:s3:::<bucket_name>"

or:

Resource": "arn:aws:s3:::<bucket_name/*>"

while `s3:getBucketLocation` will still need to be at the bucket level, the rest of the permissions could be scoped to a specific prefix.

However, the OpenAPI Spec doesn't currently allow unescaped slashes in path parameters:
https://github.com/OAI/OpenAPI-Specification/issues/892

and if you include a prefix, HyP3 will return:
```json
{
"status": 404,
"detail": "The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.",
"title": "Not Found",
"type": "about:blank"
}

It looks like we might be able to hack around it by specifying

allowReserved: true  # Prevents encoding of / to %2F

in the bucket_name specification, but handling encoded vs not-encoded slashes sounds complicated and possible more touble than it's worth.

Alternatively, we could provide a POST endpoint to bucket-policy which would allow more customization of the policy, but I think it adds a bit of complexity that we could likely just handle in the docs since most users who'll have access to apply an S3 policy to a bucket should theoretically understand how to use the provided policy as a template and adjust its scope.