Allow customizable email address for service accounts

Background

In Allow customizable username and display name fo... (#415973 - closed), the issue was originally scoped to also include the ability to customize a service account's email address. As we went into implementation, we ran into some extra complications around this requirement, so we decided to split it off into its own separate issue.

⚠ If we want to allow setting emails with domains the group owns for their service accounts, we should exclude service accounts from automatic claims of enterprise users first. Otherwise service accounts marked as enterprise user will be disabled by disable_personal_access_tokens group setting.

Open Questions

• Can we map those email notifications to group owner, or can use completely customizable email address (doubtful)
• Email verification (more here
• Comment from Drew here on use cases
• Related: (E-mail) notifications for service accounts (#428750 - closed)