Clarifies how to use `global.serviceAccount keys`:

* Clarifies the description of each key.
* Adds a note about not using `create=true` with a global name.
* Adds a checkConfig entry to help users avoid the misconfiguration
  above.
* Adds tests to confirm the checkConfig entry works as expected.

Changelog: other