Update Gerrit permissions for global service users (built at http://cl/893733512)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: SLSA Policy Verification Service Accounts
    label-SLSA-Policy-Verified:
      ALLOW: SLSA Policy Verification Service Accounts

groups

diff --git a/groups b/groups
index 1610475..2c989ff 100644
--- a/groups
+++ b/groups
@@ -1,6 +1,7 @@
 # UUID                                  	Group Name
 #
 10f1f90b56e5c67fe3754f0e79a11078d3be27f7	Approvers
+64aa5c40843772f1f9b44a83e6f5b30c041a55b3	SLSA Policy Verification Service Accounts
 9bc22fa4f697d9ac2767e8edc1ba8d5c716b1f22	Reviewers
 eac29dd93c6a9726e9744c4ad1453d4788f21717	Admins
 global:Anonymous-Users                  	Anonymous Users

project.config

diff --git a/project.config b/project.config
index ae0b48f..ea17990 100644
--- a/project.config
+++ b/project.config
@@ -47,6 +47,8 @@
 	submit = group Approvers
 	submit = group Project Owners
 	submit = group mdb/cuelang-repo
+	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
+	Read = group SLSA Policy Verification Service Accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	create = group Admins