Add chromium:public realm

Add an all-purpose "chromium:public" realm where everything is public.

Change-Id: I60d98ff828063d024b98d153335a4a36a775c6cc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2335354Reviewed-by: Roberto Carrillo <robertocn@chromium.org>
Reviewed-by: Garrett Beaty <gbeaty@chromium.org>
Commit-Queue: Nodir Turakulov <nodir@chromium.org>
Cr-Commit-Position: refs/heads/master@{#794167}

infra/config/dev/dev.star

@@ -42,4 +42,16 @@ luci.milo(
     logo = 'https://storage.googleapis.com/chrome-infra-public/logo/chromium.svg',
 )
 
+# An all-purpose public realm.
+luci.realm(
+    name = 'public',
+    bindings = [
+        luci.binding(
+            roles = 'role/buildbucket.reader',
+            groups = 'all',
+        ),
+        # Other roles are inherited from @root which grants them to group:all.
+    ],
+)
+
 exec('//dev/subprojects/chromium/subproject.star')

infra/config/generated/realms-dev.cfg

@@ -47,3 +47,10 @@ realms {
     principals: "user:luci-scheduler-dev@appspot.gserviceaccount.com"
   }
 }
+realms {
+  name: "public"
+  bindings {
+    role: "role/buildbucket.reader"
+    principals: "group:all"
+  }
+}

infra/config/generated/realms.cfg

@@ -144,6 +144,13 @@ realms {
     principals: "group:project-chromium-ci-schedulers"
   }
 }
+realms {
+  name: "public"
+  bindings {
+    role: "role/buildbucket.reader"
+    principals: "group:all"
+  }
+}
 realms {
   name: "try"
   bindings {

infra/config/main.star

@@ -90,6 +90,18 @@ luci.notify(
     tree_closing_enabled = True,
 )
 
+# An all-purpose public realm.
+luci.realm(
+    name = 'public',
+    bindings = [
+        luci.binding(
+            roles = 'role/buildbucket.reader',
+            groups = 'all',
+        ),
+        # Other roles are inherited from @root which grants them to group:all.
+    ],
+)
+
 exec('//recipes.star')
 
 exec('//notifiers.star')