Update Gerrit permissions for global service users (built at http://cl/893733512)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: SLSA Policy Verification Service Accounts
    label-SLSA-Policy-Verified:
      ALLOW: SLSA Policy Verification Service Accounts

groups

diff --git a/groups b/groups
index bb51151..e7b649d 100644
--- a/groups
+++ b/groups
@@ -1,6 +1,7 @@
 # UUID                                  	Group Name
 #
 25e1cfff90e3f648aa2acd2ee42818ea5b7177ce	gn-scoped
+5c109e6b6e3bc0590371cb5ece58e716ada4b5da	SLSA Policy Verification Service Accounts
 global:Anonymous-Users                  	Anonymous Users
 global:Project-Owners                   	Project Owners
 global:Registered-Users                 	Registered Users

project.config

diff --git a/project.config b/project.config
index cd05e1c..021d368 100644
--- a/project.config
+++ b/project.config
@@ -31,6 +31,8 @@
 	push = +force group mdb/gn-gerrit-owners
 	submit = group Project Owners
 	submit = group mdb/gn-gerrit-owners
+	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
+	Read = group SLSA Policy Verification Service Accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	create = group Project Owners