A recent change added toggleWIPstate to two ACL files, but missed the required "group" keyword. Correct them now so Gerrit won't reject manage-project's pushes during deployment. Change-Id: Ibae9274127e904337f57813974f5745c41980c9e