Migrate to clarified superproject subscription ACL

In https://gerrit-review.googlesource.com/80511, allowSuperproject.<project>.refs
was split into separate 'all' and 'matching' configuration items to clarify the
semantics. See https://gerrit-review.googlesource.com/Documentation/user-submodules.html#acl_refspec
for details.
diff --git a/project.config b/project.config
index 79f43ce..6976140 100644
--- a/project.config
+++ b/project.config
@@ -11,7 +11,7 @@
 	label-Verified = -1..+1 group gerrit-verifiers
 	submit = group Project Owners
 [access "refs/tags/*"]
-	pushTag = group Project Owners
+	createTag = group Project Owners
 [access "refs/*"]
 	owner = group google/gerritcodereview-maintainers@googlegroups.com
 [receive]
@@ -24,4 +24,4 @@
 	push = group Registered Users
 	pushMerge = group Registered Users
 [allowSuperproject "gerrit"]
-	refs = refs/heads/*:refs/heads/*
+	matching = refs/heads/*:refs/heads/*