restore_object_role is missing s3:GetObjectTagging and s3:PutObjectTagging required for S3 CopyObject

[paulpilone]

When testing v10.0.0-beta I was able to reproduce an S3 AccessDenied error during the copy_to_archive task. It appears that in this commit 9693fe7 modified the restore_object_role policy and removed the wildcard from s3:GetObject and s3:PutObject actions. In order for the CopyObject command to work the s3:GetObjectTagging and s3:PutObjectTagging are needed on the source and destination buckets and must be explicitly added.

It's possible that only the Get is required on the source bucket and Put on the destination buckets; however, I'm not familiar enough with the role's use cases to make that decision.

Note: this was found during testing against v10.0.0-beta and Cumulus v19.