Migrate to clarified superproject subscription ACL

In https://gerrit-review.googlesource.com/80511, allowSuperproject.<project>.refs
was split into separate 'all' and 'matching' configuration items to clarify the
semantics. See https://gerrit-review.googlesource.com/Documentation/user-submodules.html#acl_refspec
for details.