tendril: add access for ldap groups ops and nda

As the wmf is organisation specific and others also need access, the
restriction should be replaced with the groups ops and nda. The group nda was
newly created for cases like this. This still retains access for the wmf group
because we don't know who from that group needs access.

Change-Id: I1e8ccb91ee9985e0a6cf3076f31655bf1e823a0e