Service accounts can be created by top-level group owners on self-managed

Based on a discussion with a customer, we identified that on self-managed instances, owners of top-level groups can create service accounts. Based on our documentation/intent this should be limited to SM admins only while top-level group owners should be able to create service accounts on GitLab.com