graphite: add access for ldap groups ops and nda

As the wmf is organisation specific and others also need accessi, the
restriction should be replaced with the groups ops and nda. The group nda was
newly created for cases like this. This still retains access for the wmf group
because we don't know who from that group needs access.

RT: 8102
Change-Id: Ie621a1f2732fcad872b8b84396b02cc1d4563de5
Merge "graphite: add access for ldap groups ops and nda" into production