Enable the CI service account to trigger tasks in luci.chromium.ci.

Bug: 1137576
Change-Id: I40c5647cbdf6773e0c37285b1b4d4b4c7c8c0f07
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2466839
Auto-Submit: Garrett Beaty <gbeaty@chromium.org>
Reviewed-by: Erik Staab <estaab@chromium.org>
Commit-Queue: Erik Staab <estaab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816379}

infra/config/generated/realms.cfg

@@ -71,6 +71,10 @@ realms {
     role: "role/buildbucket.triggerer"
     principals: "group:project-chromium-ci-schedulers"
   }
+  bindings {
+    role: "role/swarming.taskTriggerer"
+    principals: "user:chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
 }
 realms {
   name: "codesearch"
@@ -137,6 +141,7 @@ realms {
     role: "role/swarming.poolUser"
     principals: "project:chromium-m86"
     principals: "project:chromium-m87"
+    principals: "user:chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
 }
 realms {

infra/config/swarming.star

@@ -61,6 +61,12 @@ swarming.pool_realm(
     projects = [details.project for details in ACTIVE_MILESTONES.values()],
 )
 
+swarming.task_triggerers(
+    builder_realm = "ci",
+    pool_realm = "pools/ci",
+    users = ["chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"],
+)
+
 # Realm with bots that run try builds.
 #
 # The tasks here are also triggered via Buildbucket. See comment above.