Fix service account privilege escalation

[donatello]

Description

• Ensure that a regular unprivileged user is unable to create service accounts
  for other users/root.

This fix includes tests to check this scenario is not possible.

Motivation and Context

Fixes a security issue where an unprivileged user is able to create service accounts for root or other user and then is able to assume their access policies via the generated credentials.

This is a regression that has existed since version RELEASE.2021-12-09T06-19-41Z.

How to test this PR?

mc admin user add myminio foo foobar123
mc admin policy set myminio readonly user=foo
MC_HOST_foo=http://foo:foobar123@localhost:9000 mc admin user svcacct add foo someOtherUser

The last command above should fail.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Optimization (provides speedup with no functional changes)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Fixes a regression (introduced in Fix LDAP service account creation #13849)
• Documentation updated
• Unit tests added/updated

[harshavardhana]

Will open a security tracker for this @donatello

[donatello]

Will open a security tracker for this @donatello

Ack

[minio-trusted]

Mint Automation

Test	Result
mint-large-bucket.sh	✔️
mint-fs.sh	✔️
mint-gateway-s3.sh	✔️
mint-erasure.sh	✔️
mint-dist-erasure.sh	✔️
mint-gateway-nas.sh	✔️
mint-compress-encrypt-dist-erasure.sh	✔️
mint-pools.sh	✔️
Deleting image on docker hub
Deleting image locally

[vadmeste]

LGTM