Update Gerrit permissions for global service users (built at http://cl/899219124)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
      ALLOW: autoupdate-onboarding-service-accounts
    Submit:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
    Push:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
  Section [GLOBAL_CAPABILITIES]:
    viewAllAccounts:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts
      ALLOW: autoupdate-onboarding-service-accounts

groups

diff --git a/groups b/groups
index 88ada26..7a088f2 100644
--- a/groups
+++ b/groups
@@ -1,10 +1,13 @@
 # UUID                                                        	Group Name
 #
+07a56f2cffa4bd0538fc73f8b7fccb2330bdd53c                      	autoupdate-service-accounts
 090e2829b3a2ff324d5c288f4c7bb82d3389fa8e                      	owners-override
+1ff3db338138ed69235014f98a07a1ff36ef7aa9                      	autoupdate-onboarding-service-accounts
 3455fbf9e059eec0ea3966774b7fda29e10101d3                      	SLSA Policy Verification Service Accounts
 5bfa1e6d0fc0cd988605571affca89e60a7aa1a1                      	bot-commit-bots
 b8e19f14ecb618ea6c5d3dca892a7d80105ed6af                      	gerrit-submit-requirements-admins
 cria:project-dawn-committers                                  	cria/project-dawn-committers
+d286f5c70ec774d0b30d87cc51ede4d77e13f967                      	autoupdate-vigil-service-accounts
 d88594eff8d639cb82d00cdda77f3ec69a8463a0                      	dawn-scoped@luci-project-accounts.iam.gserviceaccount.com
 e6a605e72c494a2fbf0c51f14cd0f24fb7ae1e50                      	gerrit-flows
 e8a7a6ec5578b7b3fb664b063b34b1278f7409e2                      	tint-scoped@luci-project-accounts.iam.gserviceaccount.com

project.config

diff --git a/project.config b/project.config
index 1b74e97..5a5409b 100644
--- a/project.config
+++ b/project.config
@@ -26,13 +26,20 @@
 	label-Code-Review = -2..+2 group cria/project-dawn-committers
 	label-Code-Review = -1..+1 group Registered Users
 	push = group Project Owners
+	push = group autoupdate-service-accounts
+	push = group autoupdate-vigil-service-accounts
 	push = group mdb/webgpu-dawn-admin
 	submit = group Project Owners
+	submit = group autoupdate-service-accounts
+	submit = group autoupdate-vigil-service-accounts
 	submit = group mdb/webgpu-dawn-admin
 	label-Bot-Commit = +0..+1 group bot-commit-bots
 	label-Owners-Override = +0..+1 group owners-override
 	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
 	Read = group SLSA Policy Verification Service Accounts
+	Read = group autoupdate-onboarding-service-accounts
+	Read = group autoupdate-service-accounts
+	Read = group autoupdate-vigil-service-accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	create = group Project Owners
@@ -97,6 +104,9 @@
 	administrateServer = group mdb/webgpu-dawn-admin
 	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
 	runAs = group gerrit-flows
+	viewAllAccounts = group autoupdate-onboarding-service-accounts
+	viewAllAccounts = group autoupdate-service-accounts
+	viewAllAccounts = group autoupdate-vigil-service-accounts
 	viewAllAccounts = group dawn-scoped@luci-project-accounts.iam.gserviceaccount.com
 	viewAllAccounts = group gerrit-flows
 	viewAllAccounts = group mdb/copybara-git-readers