project.config: add gwsq permissions

Following go/gwsq-gerrit#setting-up-the-gerrit-repository: grant gwsq
Create and View Accounts, plus Remove Reviewer per the second
instruction in step 5.

For http://b/233766453.

Change-Id: I9b39a9e228eecce6e6ab2c01ae4ad553af9a039e
diff --git a/groups b/groups
index 242c815..9251848 100644
--- a/groups
+++ b/groups
@@ -19,3 +19,4 @@
 mdb:golang-gob-eng-policy                                     	mdb/golang-gob-eng-policy
 mdb:golang-gob-owners                                         	mdb/golang-gob-owners
 mdb:google-cla-gerrit-robot-accounts                          	mdb/google-cla-gerrit-robot-accounts
+mdb:gwsq                                                      	mdb/gwsq
diff --git a/project.config b/project.config
index 6174dfd..f9fb87c 100644
--- a/project.config
+++ b/project.config
@@ -11,6 +11,7 @@
 [access "refs/*"]
 	read = group Anonymous Users
 	viewDrafts = group gobot
+	removeReviewer = group mdb/gwsq
 	revert = group Registered Users
 [access "refs/for/refs/heads/*"]
 	push = group Registered Users
@@ -23,8 +24,8 @@
 	forgeAuthor = group may-push
 	forgeCommitter = group gerritbot
 	forgeCommitter = group may-push
-	label-Code-Review = 0..+2 group approvers
-	label-Code-Review = 0..+1 group Registered Users
+	label-Code-Review = +0..+2 group approvers
+	label-Code-Review = +0..+1 group Registered Users
 	label-Hold = +0..+1 group approvers
 	submit = group approvers
 	submit = group gobot
@@ -41,11 +42,11 @@
 	push = group may-push
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = label-Code-Review push read submit
+	read = group mdb/gerritcodereview-eng
 	read = group mdb/golang-gob-eng-policy
 	read = group mdb/golang-gob-owners
-	read = group mdb/gerritcodereview-eng
 	push = group mdb/golang-gob-owners
-	label-Code-Review = 0..+2 group mdb/golang-gob-owners
+	label-Code-Review = +0..+2 group mdb/golang-gob-owners
 	submit = group mdb/golang-gob-owners
 [access "refs/tags/*"]
 	push = group may-push
@@ -115,6 +116,7 @@
 	accepted = group mdb/google-cla-gerrit-robot-accounts
 [capability]
 	administrateServer = group mdb/golang-gob-owners
+	createAccount = group mdb/gwsq
 	gerrit-google-manageUsersGet = group gobot
 	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
 	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
@@ -122,6 +124,7 @@
 	viewAllAccounts = group gobot
 	viewAllAccounts = group mdb/copybara-git-readers
 	viewAllAccounts = group mdb/copybara-git-readers
+	viewAllAccounts = group mdb/gwsq
 [notify "checkins"]
 	header = to
 	email = golang-checkins@googlegroups.com
@@ -138,10 +141,12 @@
 	description = Changes that have DO NOT SUBMIT in their commit message are not submittable.
 	applicableIf = message:\"^.*(D|d)(O|o) (N|n)(O|o)(T|t) (S|s)(U|u)(B|b)(M|m)(I|i)(T|t).*\"
 	submittableIf = is:false
+	canOverrideInChildProjects = false
 [submit-requirement "Do-Not-Review"]
 	description = Changes that have DO NOT REVIEW in their commit message are not submittable.
 	applicableIf = message:\"^.*(D|d)(O|o) (N|n)(O|o)(T|t) (R|r)(E|e)(V|v)(I|i)(E|e)(W|w).*\"
 	submittableIf = is:false
+	canOverrideInChildProjects = false
 [submit-requirement "Code-Review"]
 	description = At least one Code-Review+2 is required. Self review is not allowed.
 	submittableIf = label:Code-Review=MAX,user=non_uploader
@@ -149,3 +154,4 @@
 [submit-requirement "No-Holds"]
 	description = Changes with a Hold+1 vote are not submittable.
 	submittableIf = NOT label:Hold=1
+	canOverrideInChildProjects = false