feat(cdk-ops): load access logs

- Introduces a new Lambda function `lambda/load-access-logs` that loads
  CloudFront access logs from the S3 bucket onto the data warehouse.
  `AccessLogsETL` provisions this function.
- `DataWarehouse` introduces a new method `grantQuery` that allows a
  given `IGrantable` to call the Redshift Data API. The permission is
  too permissive because I could not figure out how to obtain the ARN of
  the Redshift Serverless namespace. `DataWarehouse` exports the
  Redshift Serverless workgroup so that `AccessLogsETL` can configure
  `lambda/load-access-logs`.
- `CdkOpsStack` passes `DataWarehouse`, `LatestBoto3Layer`, and
  `LibdatawarehouseLayer` to `AccessLogsETL`.

issue codemonger-io#30