Service user API tokens

This changelog entry is added retrospectively.

Administrators can now create API tokens linked to a dedicated service user instead of an individual user account.

Developer impact: Service user API tokens provide a non-user identity for integrations. They're unaffected by changes to any individual user's role, permissions, or employment status, and actions performed with them are attributed to the service user rather than a person. Existing user API tokens continue to work unchanged, and auto-generated tokens from native integrations (for example, Power BI) are not affected.

Action required: No action required. To move a long-running integration onto a service user API token, create one via the web app.