[realms] Allow builds to trigger isolated tasks in the same realm.
[realms] Allow builds to trigger isolated tasks in the same realm.

In many cases a build running in some realm might want to trigger
Swarming tasks in the same realm (e.g. a try job triggering
isolated tests in the same realm). Allow this by default.

This is safe from abuse, since to actually launch a task the service
account still needs 'poolUser' role in the pool. The permission we
are adding here allows a build to spawn tasks in the same realm, but
only if it *also* has access to some Swarming pool to run them on.

Another caveat is that swarming.taskTriggerer role also grants
swarming.tasks.get and swarming.tasks.cancel permissions in
the realm. It means builders will be able to examine and/or cancel
all tasks running in the realm (isolated tests, other builds). This is
a bit scary. This is a reason we apply this rule only to
builderServiceAccount (i.e. accounts of Buildbucket builders), and not
to all taskServiceAccount (i.e. also accounts of isolated tests, which
we have even less control over).

R=40f3d43a28ebae3cb819288542e1c84d73d962d5@chromium.org
BUG=1123142

Change-Id: Ie994693ade132fb27c0cfdff4aad3f970e73564d
Reviewed-on: https://chromium-review.googlesource.com/c/infra/luci/luci-py/+/2399839
Reviewed-by: Robbie Iannucci <40f3d43a28ebae3cb819288542e1c84d73d962d5@chromium.org>
Commit-Queue: Vadim Shtayura <9f116ddb1b24f6fc1916a676eb17161b6c07dfc1@chromium.org>

luci/luci-py,luci/luci-py,luci/luci-py,luci/luci-py