Add API endpoints to get a single service account

Problem

The service accounts API can create, list, update, and delete service accounts. It cannot get one service account by its ID.

Group endpoints today:

• POST /groups/:id/service_accounts
• GET /groups/:id/service_accounts
• PATCH /groups/:id/service_accounts/:user_id
• DELETE /groups/:id/service_accounts/:user_id

Project endpoints follow the same shape. In both cases the single-record read is missing.

GET /users/:id can return a service account, because a service account is a user. That route is not a substitute:

• A service account has an administrable email. Seeing the email on /users requires a token with administrator access, which a group Owner does not have.
• The caller has to know that a service account is a user, and has to leave the service accounts API to read one record it just created or updated.

Proposal

Add a read endpoint for one service account at the group level and at the project level:

• GET /groups/:id/service_accounts/:user_id
• GET /projects/:id/service_accounts/:user_id

Both use the read_service_account permission, which is the same permission the list endpoints use. Each endpoint reuses the service account lookup helper already in its file, so the 400, 403, and 404 responses match the existing PATCH and DELETE routes on the same path. The response uses the existing Entities::ServiceAccount.

Implementation

Proposed in !250360 (merged).