feat(serviceauth): extract pkg/serviceauth as a standalone module

What

Extracts pkg/serviceauth into a standalone Go module, mirroring the pkg/userauth extraction: pkg/serviceauth/go.mod + go.sum, root require + local replace, CI coverage via the module:test/module:lint matrix jobs, and doc updates (docs/service-access.md, .ai/).

No behavior changes: every .go file is byte-identical to main except the package doc comment, and the module's dependency pins match the root module.

Why

Artifact Registry wants to embed this validator (including the HTTP middleware) for its internal API's service-token authentication (gitlab-org/ops/artifact-registry#356 (closed)) instead of reimplementing it. Today the package sits inside the root module, so importing it means depending on the full IAM dependency tree.

Notes for reviewers

• Version publishing needs no action: consumers pin nested modules by pseudo-version, which is how pkg/userauth is consumed today (Artifact Registry pins v0.0.0-20260813070739-da7ccf141ba9); no per-module tags exist or are needed.
• The nested-module CI jobs are consolidated into a module:test/module:lint parallel:matrix pair (userauth, serviceauth), per the CI style guide. Nothing needs: the old userauth:* job names.

Verified locally: root go build/go vet, module go test/go vet/golangci-lint/go mod tidy (no diff) all green; root go.sum unchanged (local replace).