feat: add service_accounts workspace sharing mode (#23093)

Introduce a three-way workspace sharing setting (none, everyone,
service_accounts) replacing the boolean workspace_sharing_disabled.
In service_accounts mode, only service account-owned workspaces can be
shared while regular members' share permissions are removed. Adds a
new organization-service-account system role with per-org permissions
reconciled alongside the existing organization-member system role.

Related to:
https://linear.app/codercom/issue/PLAT-28/feat-service-accounts-sharing-mode-and-rbac-role

---------

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
Co-authored-by: Kayla はな <mckayla@hey.com>

coderd/database/migrations/testdata/fixtures/000438_pre_organization_service_account_role.up.sql

@@ -0,0 +1,28 @@
+-- Fixture for migration 000443_three_options_for_allowed_workspace_sharing.
+-- Inserts a custom role named 'Organization-Service-Account' (mixed case)
+-- to ensure the migration's case-insensitive rename catches it.
+INSERT INTO custom_roles (
+    name,
+    display_name,
+    organization_id,
+    site_permissions,
+    org_permissions,
+    user_permissions,
+    member_permissions,
+    is_system,
+    created_at,
+    updated_at
+)
+VALUES (
+    'Organization-Service-Account',
+    'User-created role',
+    'bb640d07-ca8a-4869-b6bc-ae61ebb2fda1',
+    '[]'::jsonb,
+    '[]'::jsonb,
+    '[]'::jsonb,
+    '[]'::jsonb,
+    false,
+    NOW(),
+    NOW()
+)
+ON CONFLICT DO NOTHING;