Creates a service account owned by the authenticated customer. API tokens for the service account are managed separately in the DoiT console. Returns 409 when another service account of the customer already uses name. With dryRun=true the request goes through the same checks as a real create (name bounds and uniqueness, permission names, caller scope) and returns the same errors without creating anything. When the caller authenticates with a service account token, createdBy, createdByEmail and createdByUserId are null. Requires the serviceAccountCreator permission.