Update Gerrit permissions for global service users (built at http://cl/893733512)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: SLSA Policy Verification Service Accounts
    label-SLSA-Policy-Verified:
      ALLOW: SLSA Policy Verification Service Accounts

groups

diff --git a/groups b/groups
index 8d3036f..43630ba 100644
--- a/groups
+++ b/groups
@@ -9,6 +9,7 @@
 c858fde81af761c6cd3b79c6eb7922a5d57b609c                      	boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com
 cria:project-boringssl-committers                             	cria/project-boringssl-committers
 e8ca8f450a1f9ddc20e55bc6c01a83137587fd7b                      	luci-config-service-account
+f3f20e123ed28a8cdff47a343ae0bd501a1a1613                      	SLSA Policy Verification Service Accounts
 ff4af7bc5c74afa6adefe7f75f2d0a85b68db16c                      	gerrit-submit-requirements-admins
 global:Anonymous-Users                                        	Anonymous Users
 global:Change-Owner                                           	Change Owner

project.config

diff --git a/project.config b/project.config
index 4642d96..02b738e 100644
--- a/project.config
+++ b/project.config
@@ -49,6 +49,8 @@
 	label-Auto-Submit = +0..+1 group Change Owner
 	label-Bot-Commit = +0..+1 group bot-commit-bots
 	label-Owners-Override = +0..+1 group mdb/chrome-git-admins
+	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
+	Read = group SLSA Policy Verification Service Accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	read = group Project Owners