unsure currently if this affects all bookworm upgrades, but if it looks
like it, we should add this to the main upgrade procedure.

What we've discovered (with @lavamind) is that the token
policy *restricts* the user policy, so we actually need both. We
selected to do a bucket per service, and a token restricted to the
bucket.

The reboot actually takes care of this, but we often wait on this
while we look around, and having the `nologin` file around makes some
things (like sshdist on alberti) explode.

based on comparing these docs with the actual policy implemented in our
instance of minio, which includes a policy not discussed here which is
`arn:aws:s3:::gitlab*`: this policy seems sufficient to *also* grant
access to all objects in "gitlab*" buckets but I could not confirm this
anywhere in either the MiniO or Amazon documentation, which is why below
I'm explicitely adding resources definitions with the `/*` suffix to the
policy examples

for sure the `arn:aws:s3:::gitlab` resource does not allow creating any
bucket other than one named "gitlab"

Closes: team#41296

This will typically be `grml` if we're booted in there and haven't
changed the hostname yet, but that's better than a hardcoded
`fsn-node-04`.