aws/ci security fix

[galmasi]

This fix ensures that

(a) PRs based on forks can be opened on the attestation operator and will be evaluated by the AWS/EC2 framework
(b) no EC2 secrets are given away to the submitted of the PR -- all the PR code gets to see are temporary credentials for a short-lived EC2 virtual machine and kubernetes cluster.

The implementation is as follows:

• we check out both the PR and target branches
• All CI setup runs from the target branch (which is safe)
• Once the EC2 test target exists, all tests are run from the PR branch (to evaluate the PR)
• At the end of the exercise the CI setup from the target branch ensures that the EC2 resources are freed
• All temporary credentials that were ceded to the PR branch lose meaning at the end of the test.

[mpeters]

Just to understand the security context, for untrusted people they would still need to have their PRs approved by a maintainer (after code inspection) first before it runs in CI correct? Otherwise someone's PR could bypass the restrictions by having a loooong running CI job that did some crypto mining right?