Service Account Management

Add support for Service Accounts.

Service Accounts would be tied to CO Services, which is where Identifier Assignment (Service Account Identifiers need to not collide with regular Cluster Account identifiers), Group Management, and Provisioning would be managed. Service Accounts would also have a CO Person sponsor (and should maybe show up in the CO Person's list of accounts) that can be changed as needed.

TBD: Should Service Accounts be their own Cluster Account type (plugin) that can then be provisioned (overlaid) with a standard (eg: Unix) Cluster Account, or should Service Accounts be a separate thing that apply to any type of Cluster Account?

It might be useful to have an Enrollment Flow style mechanism to request an account with a sponsor and then have it approved prior to account creation. This is more suitable for PE Enrollment Flows, but could be a Plugin before then.