Creates a service account owned by the authenticated customer. It cannot authenticate anything until it has an API token; mint one with the api-tokens sub-resource. Returns 409 when another service account of the customer already uses name. With dryRun=true the request goes through the same checks as a real create (name bounds and uniqueness, permission names, caller scope) and returns the same errors without creating anything. When the caller authenticates with a service account token, createdBy, createdByEmail and createdByUserId are null. Requires the serviceAccountCreator permission.