Pre-merge OpenQA testing: Allow running s3-image and test-s3-image on all merge requests
The s3-image job pushes ISO images from 'master' to os.gnome.org, this works because 'master' is a protected branch and has access to the S3 credentials.
We cannot make the S3 credentials available on all branches as they could be leaked in a CI pipeline script via 'echo', and then used to push malicious ISO images to os.gnome.org.
Alternative solution is to create separate IAM credentials for unprotected branches, which only have push access to a subset of the s3 repo where images can be marked as untrusted. We need a way for the s3-image and test-s3-image jobs to access the correct bucket based on whether the branch is protected or not, this could be done with an env var or .ini fle.
This will unlock pre-merge OpenQA testing for all gnome-build-meta branches.