Create a service account

Create a service account with optional initial role bindings; the client secret is returned only once.