Cleanup access permissions

1) Remove most gerritbot permissions. gerritbot should only need the ability
to forge, beyond what everyone has.

2) Remove admin permissions. It doesn't add any security because we can
still edit the settings, but it prevents us from doing damage by mistake.

3) Fix a couple of over-broad scopes, and places where release-managers
(which ideally would be smaller) was used in place of osp-team.

4) may-remove-reviewer just contains approvers, remove the indirection.

5) Delete the nobody group. If we need to escalate permissions, we
should do it with scoped groups like may-force-push and release-managers.

6) Override the default letting anyone add patch sets to anyone else's CLs.
https://gerrit-review.googlesource.com/Documentation/access-control.html#category_add_patch_set

Change-Id: I1b19d01818de9ae26ee05ce2ccc0b99214990ea3
Reviewed-on: https://go-review.googlesource.com/c/All-Projects/+/197301
Reviewed-by: Andrew Bonventre <andybons@golang.org>

groups

diff --git a/groups b/groups
index 78f6e71..c0c882a 100644
--- a/groups
+++ b/groups
@@ -1,6 +1,5 @@
 # UUID                                                        	Group Name
 #
-05717425690d91333dd0b89591e6afdce8de2084                      	nobody
 28af6c56d29f40fcca6fef99686e58212a7177bf                      	trybot-result-changers
 3d01bedfad4f1f421e4614b4e56d1cbb02d6d6cd                      	may-force-push
 420ead950461b5f205dd05e8a48e54ec518170b0                      	admins
@@ -12,8 +11,8 @@
 a68e77fe594e959daaacc2fb670298964f78acfa                      	approvers
 adf76ba6894d57eca12698844876eafed66f9990                      	gerritbot
 c7bf27e6d6fe0835046491033e39afd234b33db5                      	may-abandon-changes
-de21c3809118e05536fe5395520d53cefe2a7f4d                      	may-remove-reviewer
 df7e96111acb673748b3161cac96c45ca77a5994                      	may-forge-author-identity
+fbc20f8f1e6dec44376ef3524c9f6ed5fd35209b                      	osp-team
 global:Anonymous-Users                                        	Anonymous Users
 global:Project-Owners                                         	Project Owners
 global:Registered-Users                                       	Registered Users

project.config

diff --git a/project.config b/project.config
index fcdb289..0f0c8f9 100644
--- a/project.config
+++ b/project.config
@@ -10,29 +10,18 @@
 	action = cherry pick
 [access "refs/*"]
 	read = group Anonymous Users
-	create = group gerritbot
-	forgeAuthor = group gerritbot
-	forgeAuthor = group may-forge-author-identity
-	forgeCommitter = group gerritbot
-	push = group gerritbot
-	pushMerge = group gerritbot
-	abandon = group may-abandon-changes
 	viewDrafts = group gobot
-[access "refs/for/refs/*"]
+[access "refs/for/refs/heads/*"]
 	push = group Registered Users
 	pushMerge = group Registered Users
 [access "refs/heads/*"]
-	create = group admins
-	create = group gerritbot
+	create = group osp-team
 	create = group release-managers
-	forgeAuthor = group admins
 	forgeAuthor = group gerritbot
+	forgeAuthor = group may-force-push
 	forgeAuthor = group may-forge-author-identity
-	forgeCommitter = group admins
 	forgeCommitter = group gerritbot
 	forgeCommitter = group may-force-push
-	push = group admins
-	push = group gerritbot
 	push = +force group may-force-push
 	label-Code-Review = -2..+2 group approvers
 	label-Code-Review = -1..+1 group Registered Users
@@ -44,7 +33,8 @@
 	editHashtags = group gobot
 	labelAs-TryBot-Result = group trybot-result-changers
 	label-TryBot-Result = -1..+1 group gobot
-	removeReviewer = group may-remove-reviewer
+	removeReviewer = group approvers
+	abandon = group may-abandon-changes
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	read = group Project Owners
@@ -59,14 +49,8 @@
 	create = group admins
 	create = group mdb/gerritcodereview-sre
 [access "refs/tags/*"]
-	push = group may-force-push
-	push = group nobody
 	push = group release-managers
-	create = group may-force-push
-	create = group nobody
 	create = group release-managers
-	createTag = group nobody
-	createSignedTag = group nobody
 	forgeAuthor = group release-managers
 	forgeCommitter = group release-managers
 [label "Code-Review"]
@@ -91,13 +75,14 @@
 	value = 0 No results
 	value = +1 TryBots succeeded
 [access "refs/for/*"]
-	addPatchSet = group Registered Users
+	addPatchSet = group approvers
+	exclusiveGroupPermissions = addPatchSet
 [commitmessage]
 	maxSubjectLength = 1000
 	maxLineLength = 1000
 [access "^refs/heads/release-branch.+"]
 	exclusiveGroupPermissions = submit
-	submit = group release-managers
+	submit = group osp-team
 [accounts]
 	sameGroupVisibility = deny group contributed-in-past
 	sameGroupVisibility = deny group google/google-union:signcla