Grant viewer only permissions to ci infrastructure. (kubeflow#168)

* It turns out we already had a group ci-viewer@kubeflow.org but
  we weren't sync'ing its membership to GIT.

* Grant the group logging and container viewer permission on project
  kubeflow-ci and kubeflow-ci-deployment

* Prune inactive members from ci-team and move others to ci-viewer.

* Update update_iam_policy.sh to use the latest version of yq which
  has some syntax changes.

ci-team.members.txt

@@ -1,15 +1,6 @@
-abolfazl.shahbazi@intel.com
-caicloud-team@kubeflow.org
 cartick@google.com
-cc@seldon.io
-deyuan@caicloud.io
-gaoce@caicloud.io
 google-team@kubeflow.org
-holden.karau@gmail.com
 kam.d.kasravi@intel.com
 kunming@google.com
 lunkai@google.com
-michellecasbon@google.com
-redhat-team@kubeflow.org
-wibuch@microsoft.com
 yangpa@google.com

ci-viewer.members.txt

@@ -0,0 +1,6 @@
+abolfazl.shahbazi@intel.com
+cc@seldon.io
+gaoce@caicloud.io
+hejinchi@cn.ibm.com
+holden.karau@gmail.com
+redhat-team@kubeflow.org