Update Gerrit permissions for global service users (built at http://cl/899219124)

Added permissions:
  Section [refs/heads/*]:
    Read:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-onboarding-service-accounts
      ALLOW: autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg==
    Submit:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg==
    Push:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg==
  Section [GLOBAL_CAPABILITIES]:
    viewAllAccounts:
      ALLOW: autoupdate-vigil-service-accounts
      ALLOW: autoupdate-onboarding-service-accounts
      ALLOW: autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg==

groups

diff --git a/groups b/groups
index d92a5f0..45fee64 100644
--- a/groups
+++ b/groups
@@ -2,10 +2,13 @@
 #
 69728fadfa4b65b76c1ab6279e3811c7bac871ca                      	gobot
 758bde83fec3c204baaca867a310d7beb3c732ea                      	SLSA Policy Verification Service Accounts
+7da53c40cec234188d55297dc278d7fb37f081e4                      	autoupdate-onboarding-service-accounts
 adf76ba6894d57eca12698844876eafed66f9990                      	gerritbot
+be1cde77b9379e23238f05b639d5b1c09f7c4780                      	autoupdate-vigil-service-accounts
 c7bf27e6d6fe0835046491033e39afd234b33db5                      	may-abandon-changes
 cria:project-golang-approvers                                 	cria/project-golang-approvers
 cria:project-golang-may-start-trybots                         	cria/project-golang-may-start-trybots
+d293791afcbe3f7303b3207c12effed4daddcf88                      	autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg==
 df7e96111acb673748b3161cac96c45ca77a5994                      	may-upload-all-cls
 ebedd7e04a70b1e91cab6bbec6a73155b5c44d5c                      	luci_scoped_account
 fa2a9d553c10af7c1da3b30a01ad1aecc3e0c24d                      	autoupdate-service-accounts

project.config

diff --git a/project.config b/project.config
index 2a45202..05bb94e 100644
--- a/project.config
+++ b/project.config
@@ -26,6 +26,8 @@
 	forgeAuthor = group gobot
 	forgeAuthor = group may-upload-all-cls
 	forgeCommitter = group gerritbot
+	submit = "group autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg=="
+	submit = group autoupdate-vigil-service-accounts
 	submit = group cria/project-golang-approvers
 	submit = group gobot
 	submit = group luci_scoped_account
@@ -60,6 +62,11 @@
 	labelAs-Commit-Queue = +0..+2 group luci_scoped_account
 	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
 	Read = group SLSA Policy Verification Service Accounts
+	Read = group autoupdate-onboarding-service-accounts
+	Read = "group autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg=="
+	Read = group autoupdate-vigil-service-accounts
+	Push = "group autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg=="
+	Push = group autoupdate-vigil-service-accounts
 [access "refs/for/refs/meta/config"]
 	push = group mdb/gerritcodereview-eng
 	push = group mdb/golang-gob-eng-policy
@@ -167,7 +174,10 @@
 	gerrit-google-manageUsersGet = group gobot
 	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
 	viewAccess = group gobot
+	viewAllAccounts = group autoupdate-onboarding-service-accounts
 	viewAllAccounts = group autoupdate-service-accounts
+	viewAllAccounts = "group autoupdate-service-accounts#ROUsccouXgvcNyywY5CbYg=="
+	viewAllAccounts = group autoupdate-vigil-service-accounts
 	viewAllAccounts = group gobot
 	viewAllAccounts = group luci_scoped_account
 	viewAllAccounts = group mdb/copybara-git-readers