infra: Add buildbucket.creator binding to shadow buckets

Follow-up to
https://boringssl-review.googlesource.com/c/boringssl/+/98167.

Trying to run a led job fails with:
"user:bpastene@google.com" does not have permission "buildbucket.builds.create" in bucket "boringssl/ci.shadow"

So this adds that missing binding.

Bug: None
Change-Id: Ia082a3f6efff21f4abcc33ca1707ed38a8eebbee
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/98207
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: Ben Pastene <bpastene@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>

infra/config/generated/realms.cfg

diff --git a/infra/config/generated/realms.cfg b/infra/config/generated/realms.cfg
index 50f543e..84d3ffc 100644
--- a/infra/config/generated/realms.cfg
+++ b/infra/config/generated/realms.cfg
@@ -49,6 +49,10 @@
 realms {
   name: "ci.shadow"
   bindings {
+    role: "role/buildbucket.creator"
+    principals: "group:project-boringssl-tryjob-access"
+  }
+  bindings {
     role: "role/buildbucket.triggerer"
     principals: "group:project-boringssl-tryjob-access"
     principals: "group:service-account-cq"
@@ -76,4 +80,8 @@
     role: "role/buildbucket.builderServiceAccount"
     principals: "user:boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
+  bindings {
+    role: "role/buildbucket.creator"
+    principals: "group:project-boringssl-tryjob-access"
+  }
 }

infra/config/main.star

diff --git a/infra/config/main.star b/infra/config/main.star
index bfebb09..9739ddc 100755
--- a/infra/config/main.star
+++ b/infra/config/main.star
@@ -75,6 +75,14 @@
             ],
         ),
     ],
+    bindings = [
+        luci.binding(
+            roles = "role/buildbucket.creator",
+            groups = [
+                "project-boringssl-tryjob-access",
+            ],
+        ),
+    ],
 )
 
 luci.bucket(
@@ -104,6 +112,14 @@
             "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com",
         ],
     ),
+    bindings = [
+        luci.binding(
+            roles = "role/buildbucket.creator",
+            groups = [
+                "project-boringssl-tryjob-access",
+            ],
+        ),
+    ],
 )
 
 luci.milo(