Add new kokoro reader group.

In order to support Kokoro's migration to Pod, GoB reader permissions will now be granted through the ACL group kokoro-gob-readers(-qa) instead of directly to borg roles kokoro/kokoro-dedicated(-qa).

See go/kokoro-gob-permissions-update and b/266422763 for more details.

groups

diff --git a/groups b/groups
index 7577d2c..eb7f2cb 100644
--- a/groups
+++ b/groups
@@ -13,4 +13,5 @@
 mdb:coral-eng                           	mdb/coral-eng
 mdb:kokoro                              	mdb/kokoro
 mdb:kokoro-dedicated                    	mdb/kokoro-dedicated
+mdb:kokoro-gob-readers                  	mdb/kokoro-gob-readers
 mdb:spacepark-eng                       	mdb/spacepark-eng

project.config

diff --git a/project.config b/project.config
index 15e1abe..c676437 100644
--- a/project.config
+++ b/project.config
@@ -95,21 +95,15 @@
 [access "refs/heads/4.14.98"]
 	read = group mdb/kokoro
 	read = group mdb/kokoro-dedicated
+	read = group mdb/kokoro-gob-readers
 	read = group mdb/spacepark-eng
 [capability]
 	administrateServer = group mdb/aiyprojects-gerrit-owner
 	administrateServer = group mdb/coral-eng
 	administrateServer = group mdb/spacepark-eng
 	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
 	streamEvents = group Jenkins-Build-Robot
 	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
 [submit-requirement "Presubmit"]
 	submittableIf = -label:Presubmit=MIN
 	canOverrideInChildProjects = true