Update Gerrit permissions for global service users (built at http://cl/893733512)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: SLSA Policy Verification Service Accounts
    label-SLSA-Policy-Verified:
      ALLOW: SLSA Policy Verification Service Accounts

groups

diff --git a/groups b/groups
index 47d5709..3cb999f 100644
--- a/groups
+++ b/groups
@@ -1,6 +1,7 @@
 # UUID                                                        	Group Name
 #
 0505ad05a83b9ffbdfb56b068d7b562d0f725400                      	temp_owners
+4d5d1a1ea49c7985100192f98533c0895c13c9f8                      	SLSA Policy Verification Service Accounts
 global:Anonymous-Users                                        	Anonymous Users
 global:Project-Owners                                         	Project Owners
 global:Registered-Users                                       	Registered Users

project.config

diff --git a/project.config b/project.config
index 5aaf39a..09eb48b 100644
--- a/project.config
+++ b/project.config
@@ -33,6 +33,8 @@
 	editHashtags = group google/kunit-dev@google.com
 	removeReviewer = group google/kunit-dev@google.com
 	forgeAuthor = group google/kunit-dev@google.com
+	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
+	Read = group SLSA Policy Verification Service Accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	create = group Project Owners
@@ -67,9 +69,6 @@
 	administrateServer = group mdb/kunit_owners
 	administrateServer = group temp_owners
 	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
 	viewAllAccounts = group mdb/copybara-git-readers
 [submit-requirement "Code-Review"]
 	submittableIf = label:Code-Review=MAX AND -label:Code-Review=MIN