remove catrope from ops, add to "-oid"-roots

apparently Roan doesn't want root anymore,
so for that we should remove him from the ops
admin group, see ticket RT 8686

since ops gave him global access, we now add
him to relevant groups he should still keep,
which are basically all services ending in "-oid",

remove: ops
add: parsoid-roots, gerrit-root, deployment,
     mathoid-roots/admins, citoid-roots

this is still removing a bunch of access

Change-Id: I21864c1742580758bf37fb48460323e04df38c4a
RT: 8686