Backport Service Account into 2.x branch

[RyanL1997]

Description

Backport Service Account into 2.x branch

Related Issues

• Require Backport On-Behalf-Of Authentication into 2.x branch #3555
• Relate [META] Service Accounts #2944

Exit Criteria

Backport the following changes:

OpenSearch Core [This should be backported to 2.x first]: opensearch-project/OpenSearch#11052

• Implement on behalf of token passing for extensions OpenSearch#8679
• Provide service accounts tokens to extensions OpenSearch#9618
• Remove the authenticate token method from TokenManager and from the Subject interface OpenSearch#10614
• OnBehalfOf claims take second duration OpenSearch#10664

Securtiy Plugin: #3639

• Implement IdentityPlugin in Security plugin #3538
• Limit service account permission #3607
• Add backend filtering for legacy internal user and service accounts #2786
• OnBehalfOf tokens odds and ends #3593