gerrit: change retired.config acls

This patch updates the retired.config ACL to allow for the technical
commitee to be able to push changes into the repositories which are
retired.

The ACLs allows tech-committee group members to set all labels onto
changes as well as allowing them exclusive rights to push (therefore not
allowing any other members) and giving them access to submit changes (in
order to skip our gating).

The goal is to evenutally replace this group by another one once the
ACLs are verified to be working.

Change-Id: Ia6d516621ec405b02f3f97340d96d9938b605d8f

gerrit/acls/openstack/retired.config

@@ -1,2 +1,16 @@
-[project]
+[access "refs/for/refs/heads/*"]
-state = read only
+exclusiveGroupPermissions = push
+push = group tech-committee
+submit = group tech-committee
+
+[access "refs/heads/*"]
+label-Code-Review = -2..+2 group tech-committee
+label-Verified = -2..+2 group tech-committee
+label-Workflow = -1..+1 group tech-committee
+
+[receive]
+requireChangeId = true
+requireContributorAgreement = true
+
+[submit]
+mergeContent = true

tools/normalize_acl.py

@@ -82,6 +82,7 @@ valid_keys = {'abandon',
               'requireChangeId',
               'requireContributorAgreement',
               'state',
+              'submit',
               'value'}
 
 if '0' in transformations or not transformations: