Update Gerrit permissions for global service users (built at http://cl/893733512)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: SLSA Policy Verification Service Accounts
    label-SLSA-Policy-Verified:
      ALLOW: SLSA Policy Verification Service Accounts

groups

diff --git a/groups b/groups
index b261fca..b77ad9e 100644
--- a/groups
+++ b/groups
@@ -1,10 +1,11 @@
-# UUID                        	Group Name
+# UUID                                  	Group Name
 #
-global:Anonymous-Users        	Anonymous Users
-global:Project-Owners         	Project Owners
-global:Registered-Users       	Registered Users
-mdb:copybara-git-readers      	mdb/copybara-git-readers
-mdb:copybara-git-writers      	mdb/copybara-git-writers
-mdb:eng-mirror                	mdb/eng-mirror
-mdb:opensource-compliance-team	mdb/opensource-compliance-team
-mdb:third-party-mirror-owner  	mdb/third-party-mirror-owner
+79be56805a57408ce621046029781feb7aabfe2b	SLSA Policy Verification Service Accounts
+global:Anonymous-Users                  	Anonymous Users
+global:Project-Owners                   	Project Owners
+global:Registered-Users                 	Registered Users
+mdb:copybara-git-readers                	mdb/copybara-git-readers
+mdb:copybara-git-writers                	mdb/copybara-git-writers
+mdb:eng-mirror                          	mdb/eng-mirror
+mdb:opensource-compliance-team          	mdb/opensource-compliance-team
+mdb:third-party-mirror-owner            	mdb/third-party-mirror-owner

project.config

diff --git a/project.config b/project.config
index 6a0498a..da1061a 100644
--- a/project.config
+++ b/project.config
@@ -40,6 +40,8 @@
 	submit = group Project Owners
 	submit = group mdb/opensource-compliance-team
 	submit = group mdb/third-party-mirror-owner
+	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
+	Read = group SLSA Policy Verification Service Accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	create = group Project Owners