Cleanup access permissions

1) Remove most gerritbot permissions. gerritbot should only need the ability
to forge, beyond what everyone has.

2) Remove admin permissions. It doesn't add any security because we can
still edit the settings, but it prevents us from doing damage by mistake.

3) Fix a couple of over-broad scopes, and places where release-managers
(which ideally would be smaller) was used in place of osp-team.

4) may-remove-reviewer just contains approvers, remove the indirection.

5) Delete the nobody group. If we need to escalate permissions, we
should do it with scoped groups like may-force-push and release-managers.

6) Override the default letting anyone add patch sets to anyone else's CLs.
https://gerrit-review.googlesource.com/Documentation/access-control.html#category_add_patch_set

Change-Id: I1b19d01818de9ae26ee05ce2ccc0b99214990ea3
Reviewed-on: https://go-review.googlesource.com/c/All-Projects/+/197301
Reviewed-by: Andrew Bonventre <andybons@golang.org>