[sentry-junior]

Allows service account access tokens to be authenticated

Stacked on #130679.

Adds ServiceAccountTokenAuthentication, which accepts sntrym_ bearer tokens. It's registered right after OrgAuthTokenAuthentication, both in the API's default authenticators and in the auth middleware (so rate limits key on the same identity the endpoint sees).

How a token becomes a request credential:

• It looks up the active token by hash: ServiceAccountTokenReplica in the cell, ServiceAccountToken in control. Revoked (date_deactivated set) and expired tokens return 401.
• It resolves the account with resolve_service_account. That's the same helper the viewer-context path uses, so it applies the same checks: the account is active and in the token's org, and the org has organizations:service-accounts. We reuse that flag instead of adding a separate token flag, since service accounts aren't available outside the internal org yet.
• It returns the same service_account AuthenticatedToken as viewer-context auth, with entity_id set to the account ID. Access, project reach, service_account:<id> rate limits and creator attribution work without changes.
• The credential's scopes are the token's scopes intersected with the account's current scopes. Narrowing the account narrows its existing tokens, but widening the account doesn't widen them.
• On URLs with organization_id_or_slug, a token for another org fails with a 401. Access would deny it anyway, but this gives a clear error and covers endpoints that never build access.

Not in this PR: throttled date_last_used updates, which need a cell-to-control RPC, the management endpoints for creating and revoking tokens, and the token column in the service-account auth matrix.

via @skaasten.

--

View Session [Sentry]