Moves the token between active and disabled by setting state. Disabling takes effect
immediately: the token stops authenticating until it is re-enabled. Setting the state a
token already has succeeds and changes nothing.

The two directions are not symmetric. Disabling a token whose expiry has passed succeeds,
but re-enabling an expired token returns 422 — expiry is final, and a new token has to be
created instead. deleted and expired are not accepted values: a token is deleted through
the delete operation, and expires on its own.

With dryRun=true nothing is written and the response body is the token as it would look
after the change, so a 422 here means a real request would also be refused. Requires the
serviceAccountManager permission.