feat: add service_accounts workspace sharing mode (#23093)

Introduce a three-way workspace sharing setting (none, everyone,
service_accounts) replacing the boolean workspace_sharing_disabled.
In service_accounts mode, only service account-owned workspaces can be
shared while regular members' share permissions are removed. Adds a
new organization-service-account system role with per-org permissions
reconciled alongside the existing organization-member system role.

Related to:
https://linear.app/codercom/issue/PLAT-28/feat-service-accounts-sharing-mode-and-rbac-role

---------

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
Co-authored-by: Kayla はな <mckayla@hey.com>

coderd/rbac/authz_internal_test.go

@@ -1404,8 +1404,8 @@ func testAuthorize(t *testing.T, name string, subject Subject, sets ...[]authTes
 // RoleByName won't resolve it here. Assume the default behavior: workspace
 // sharing enabled.
 func orgMemberRole(orgID uuid.UUID) Role {
-	workspaceSharingDisabled := false
-	orgPerms, memberPerms := OrgMemberPermissions(workspaceSharingDisabled)
+	settings := OrgSettings{ShareableWorkspaceOwners: ShareableWorkspaceOwnersEveryone}
+	perms := OrgMemberPermissions(settings)
 	return Role{
 		Identifier:  ScopedRoleOrgMember(orgID),
 		DisplayName: "",
@@ -1413,8 +1413,8 @@ func orgMemberRole(orgID uuid.UUID) Role {
 		User:        []Permission{},
 		ByOrgID: map[string]OrgPermissions{
 			orgID.String(): {
-				Org:    orgPerms,
-				Member: memberPerms,
+				Org:    perms.Org,
+				Member: perms.Member,
 			},
 		},
 	}