Enable firefox-ci-playground-private to use private artifacts (bug 1989274)

[JohanLorenzo]

Updated diff after first round of comments:

--- current
+++ generated
@@ -366394,16 +366394,26 @@ Role=repo:github.com/mozilla-releng/firefox-ci-playground-private:*:
       - secrets:get:project/mozilla/firefox-ci-playground/level-1/*
       - secrets:get:project/mozilla/firefox-ci-playground/level-any/*
       - secrets:get:project/mozilla/level-1/*
       - secrets:get:project/mozilla/level-any/*
       - secrets:get:project/releng/releng-github-clone-ssh
       - secrets:get:project/taskcluster/gecko/hgfingerprint
       - secrets:get:project/taskcluster/gecko/hgmointernal

+  Role=repo:github.com/mozilla-releng/firefox-ci-playground-private:action:*:
+    roleId: repo:github.com/mozilla-releng/firefox-ci-playground-private:action:*
+    description:
+      *DO NOT EDIT* - This resource is configured automatically by [ci-admin](https://github.com/mozilla-releng/fxci-config).
+
+      Scopes in this role are defined in [fxci-config/grants.d](https://github.com/mozilla-releng/fxci-config/blob/main/grants.d).
+    scopes:
+      - queue:get-artifact:private/project/mozilla-firefox-ci-playground/*
+      - queue:get-artifact:private/project/mozilla/*
+
   Role=repo:github.com/mozilla-releng/firefox-ci-playground-private:branch:main:
     roleId: repo:github.com/mozilla-releng/firefox-ci-playground-private:branch:main
     description:
       *DO NOT EDIT* - This resource is configured automatically by [ci-admin](https://github.com/mozilla-releng/fxci-config).

       Scopes in this role are defined in [fxci-config/grants.d](https://github.com/mozilla-releng/fxci-config/blob/main/grants.d).
     scopes:
       - docker-worker:cache:mozilla-level-1-*
@@ -366413,16 +366423,18 @@ Role=repo:github.com/mozilla-releng/firefox-ci-playground-private:branch:main:
       - in-tree:hook-action:project-mozilla/in-tree-action-1-*
       - index:insert-task:mozilla.v2.firefox-ci-playground-private.*
       - index:insert-task:mozilla.v2.firefox-ci-playground.cache.level-1.*
       - queue:cancel-task:mozilla-level-1/*
       - queue:create-task:low:built-in/*
       - queue:create-task:low:mozilla-1/*
       - queue:create-task:low:mozilla-t/*
       - queue:create-task:low:releng-hardware/mozilla-b-1-*
+      - queue:get-artifact:private/project/mozilla-firefox-ci-playground/*
+      - queue:get-artifact:private/project/mozilla/*
       - queue:rerun-task:mozilla-level-1/*
       - queue:route:checks
       - queue:route:index.mozilla.v2.firefox-ci-playground-private.*
       - queue:route:index.mozilla.v2.firefox-ci-playground.cache.level-1.*
       - queue:scheduler-id:mozilla-level-1
       - secrets:get:project/mozilla/firefox-ci-playground/level-1/*
       - secrets:get:project/mozilla/firefox-ci-playground/level-any/*
       - secrets:get:project/mozilla/level-1/*
@@ -366441,16 +366453,26 @@ Role=repo:github.com/mozilla-releng/firefox-ci-playground-private:pull-request:
       - index:insert-task:mozilla.v2.firefox-ci-playground-private-pr.*
       - index:insert-task:mozilla.v2.firefox-ci-playground.cache.head.*
       - index:insert-task:mozilla.v2.firefox-ci-playground.cache.pr.*
       - queue:cancel-task-group:mozilla-level-1/*
       - queue:route:index.mozilla.v2.firefox-ci-playground-private-pr.*
       - queue:route:index.mozilla.v2.firefox-ci-playground.cache.head.*
       - queue:route:index.mozilla.v2.firefox-ci-playground.cache.pr.*
       - queue:seal-task-group:mozilla-level-1/*
+
+  Role=repo:github.com/mozilla-releng/firefox-ci-playground-private:release:*:
+    roleId: repo:github.com/mozilla-releng/firefox-ci-playground-private:release:*
+    description:
+      *DO NOT EDIT* - This resource is configured automatically by [ci-admin](https://github.com/mozilla-releng/fxci-config).
+
+      Scopes in this role are defined in [fxci-config/grants.d](https://github.com/mozilla-releng/fxci-config/blob/main/grants.d).
+    scopes:
+      - queue:get-artifact:private/project/mozilla-firefox-ci-playground/*
+      - queue:get-artifact:private/project/mozilla/*

   Role=repo:github.com/mozilla-releng/firefox-ci-playground:*:
     roleId: repo:github.com/mozilla-releng/firefox-ci-playground:*
     description:
       *DO NOT EDIT* - This resource is configured automatically by [ci-admin](https://github.com/mozilla-releng/fxci-config).

       Scopes in this role are defined in [fxci-config/grants.d](https://github.com/mozilla-releng/fxci-config/blob/main/grants.d).
     scopes:

[jcristau]

I don't think this quite matches what was discussed in the first round?

Also, there's some precedent around using "project/foo" as a prefix. Do we want to continue with that?

[JohanLorenzo]

I followed #540 (comment). Please let me know if there's anything I misunderstood.

[JohanLorenzo]

I went with private/project/foo. Let me know if you prefer project/foo alone. I like private/project/... because it explicitly shows the artifact is private but I don't have a strong opinion.

[jcristau]

I find private/project/foo redundant, so I'd rather we picked one, but I'm not going to block on that.