How should I ground a GFCI to a metal box?
You should be able to find ground screws at any home improvement store. Most boxes have a tapped hole for this purpose. If yours does not, you should be able to find grounding clips at the home improvement store as well.

Keep in mind, however, that continuity does not equal an adequate ground. Just because you have continuity between two of the boxes, does not mean you have an adequate ground all the way back to the grounding electrode. For example, the boxes might have armored cable running between them. Armored cable is only rated as a grounding conductor, if there's an internal grounding strip (which is not always the case). Armored cable could/should connect the boxes in such a way, that a continuity test would pass but does not provide a proper ground.

If you don't have an adequate ground; or you're not sure if you do or not, the best bet is to not connect the grounding terminal of the GFCI to the box. You should also place the "No Equipment Ground" sticker on the receptacle, but this is often neglected in residential situations.