Allow destroy of group service account tokens without expiry with non-admin user

Summary

This change fixes a bug where deleting a service account access token without an expiry date would fail when performed by a non-admin (Owner-level) user. Previously, the deletion logic always tried to parse the expiry date, which would crash if no expiry was set. Now, the expiry check is skipped when no expiry date exists.

A new test was added to verify that an Owner-level user can successfully create and delete a token that has no expiry date. Additionally, the repetitive code for toggling the "require token expiry" setting in tests was extracted into a shared helper function, reducing duplication across test files. A couple of minor code style cleanups were also included.

Supercedes and largely taken from !3170 (closed)