Update Gerrit permissions for global service users (built at http://cl/899219124)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
      ALLOW: autoupdate-onboarding-service-accounts
    Submit:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
    Push:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
  Section [GLOBAL_CAPABILITIES]:
    viewAllAccounts:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
      ALLOW: autoupdate-onboarding-service-accounts

groups

diff --git a/groups b/groups
index c93f34b..70e85b7 100644
--- a/groups
+++ b/groups
@@ -1,5 +1,8 @@
 # UUID                                  	Group Name
 #
+0518d86ad53e1139bc7f7e36ca925bfb0a7b4d45	autoupdate-service-accounts
+947d6e6de84eece97bf20a244eb6c88f7e7700f9	autoupdate-onboarding-service-accounts
+d83517be6b9e884e6c303d83ea19bc7b4d47c898	autoupdate-vigil-service-accounts
 e08dc62e00e5c043b3db69c051b07a17ff85847d	SLSA Policy Verification Service Accounts
 fe5252bd1343fb2de13f1447db3293a200b60bb6	Owners
 global:Anonymous-Users                  	Anonymous Users

project.config

diff --git a/project.config b/project.config
index 10fbe00..22e3e56 100644
--- a/project.config
+++ b/project.config
@@ -23,6 +23,8 @@
 	forgeCommitter = group Project Owners
 	forgeCommitter = group ldap/plan9port
 	push = group Project Owners
+	push = group autoupdate-service-accounts
+	push = group autoupdate-vigil-service-accounts
 	push = group ldap/plan9port
 	label-Code-Review = -2..+2 group Owners
 	label-Code-Review = -2..+2 group Project Owners
@@ -30,11 +32,16 @@
 	label-Code-Review = -1..+1 group Registered Users
 	submit = group Owners
 	submit = group Project Owners
+	submit = group autoupdate-service-accounts
+	submit = group autoupdate-vigil-service-accounts
 	submit = group ldap/plan9port
 	editTopicName = +force group Project Owners
 	editTopicName = +force group ldap/plan9port
 	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
 	Read = group SLSA Policy Verification Service Accounts
+	Read = group autoupdate-onboarding-service-accounts
+	Read = group autoupdate-service-accounts
+	Read = group autoupdate-vigil-service-accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	read = group Owners
@@ -67,3 +74,6 @@
 	addPatchSet = group Registered Users
 [capability]
 	administrateServer = group ldap/plan9port
+	viewAllAccounts = group autoupdate-onboarding-service-accounts
+	viewAllAccounts = group autoupdate-service-accounts
+	viewAllAccounts = group autoupdate-vigil-service-accounts