Enhancement: Service Account roles

Use a hidden role for service accounts. It will not appear in ListRoles calls but internally handled
by settings service

https://github.com/owncloud/ocis/pull/8051
https://github.com/owncloud/ocis/pull/8074
