fix: deprecate requirement of session token for service accounts (#9320)

This PR fixes couple of behaviors with service accounts

- not need to have session token for service accounts
- service accounts can be generated by any user for themselves
  implicitly, with a valid signature.
- policy input for AddNewServiceAccount API is not fully typed
  allowing for validation before it is sent to the server.
- also bring in additional context for admin API errors if any
  when replying back to client.
- deprecate GetServiceAccount API as we do not need to reply
  back session tokens

pkg/madmin/policy-commands.go

@@ -114,6 +114,10 @@ func (adm *AdminClient) AddCannedPolicy(ctx context.Context, policyName string,
 		return ErrInvalidArgument("policy input cannot be empty")
 	}
 
+	if err := policy.Validate(); err != nil {
+		return err
+	}
+
 	buf, err := json.Marshal(policy)
 	if err != nil {
 		return err