Update Gerrit permissions for global service users (built at http://cl/893733512)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: SLSA Policy Verification Service Accounts
    label-SLSA-Policy-Verified:
      ALLOW: SLSA Policy Verification Service Accounts

groups

diff --git a/groups b/groups
index 77e4cdd..0f1bd83 100644
--- a/groups
+++ b/groups
@@ -1,5 +1,6 @@
 # UUID                                  	Group Name
 #
+0e9c85fb6ef34236995b32f122b15ad3d44f355b	SLSA Policy Verification Service Accounts
 a4a28c857600649aaa774343d9372b1f88f98bb8	Google-Developer
 c038e138d18b87fcd5f0dd0ed04102bd07b23115	Jenkins-Build-Robot
 global:Anonymous-Users                  	Anonymous Users

project.config

diff --git a/project.config b/project.config
index 5b030f4..ab421f2 100644
--- a/project.config
+++ b/project.config
@@ -45,6 +45,8 @@
 	submit = group Google-Developer
 	submit = group Project Owners
 	submit = group mdb/aiyprojects-gerrit-owner
+	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
+	Read = group SLSA Policy Verification Service Accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	create = group Project Owners