Restrict invocation creation on public realm to tryjob access group

I.e. project-chromium-tryjob-access

R=estaab,vadimsh

Change-Id: I6c5fa75eac552408641b14db89ca49fd7257ffa2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2353690
Auto-Submit: Roberto Carrillo <robertocn@chromium.org>
Reviewed-by: Erik Staab <estaab@chromium.org>
Commit-Queue: Erik Staab <estaab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#797522}

infra/config/generated/realms.cfg

@@ -152,7 +152,7 @@ realms {
   }
   bindings {
     role: "role/resultdb.invocationCreator"
-    principals: "group:all"
+    principals: "group:project-chromium-tryjob-access"
   }
 }
 realms {

infra/config/main.star

@@ -110,7 +110,7 @@ luci.realm(
         ),
         luci.binding(
             roles = "role/resultdb.invocationCreator",
-            groups = "all",
+            groups = "project-chromium-tryjob-access",
         ),
         # Other roles are inherited from @root which grants them to group:all.
     ],