No longer grant third-party voting initially

* doc/source/gerrit.rst: Update documentation to reflect that the
External Testing Tools group has been replaced by two new groups
named Third-Party CI and Voting Third-Party CI. New third-party
continuous integration testing service accounts are initially added
to the first group, which allows them to apply verify votes only on
the openstack-dev/sandbox project. Once they have managed to confirm
some stability, they are moved to the second group, which is also
included by the first, so that they may apply verify votes on any
project.

* .../gerrit/acls/openstack-dev/sandbox.config: Apply verify voting
permissions for Third-Party CI group members, and correct review
activity permissions to use the Registered Users group instead of
the long-defunct openstack-cla group.

Change-Id: Ief3fef44df986d868af148787b3c456a98484091
Merge "No longer grant third-party voting initially"