Add support for a server-specific ServiceAccount

The chart currently has `server.serviceAccountName` but does not provide a way to create a ServiceAccount specifically for the server deployment. The chart-created ServiceAccount is primarily wired to the worker and carries RBAC for managed outpost/Kubernetes resource management.

It would be useful to have first-class support for a dedicated server ServiceAccount, separate from the worker ServiceAccount. As https://github.com/goauthentik/helm/issues/197#issuecomment-1712650404 states the server does not need to communicate with the Kuberntes API, but there are other use cases for utilizing Kubernetes Service Accounts for identity binding, such as [AWS IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) or [SeaweedFS AssumeRoleWithWebIdentity](https://github.com/seaweedfs/seaweedfs/wiki/OIDC-Integration) for S3 access. The server may need S3 access for media/files, while it should not necessarily inherit the worker’s Kubernetes RBAC by setting.

The request here is a chart-managed way to create one and assign it to the server deployment, with annotations configurable by values (for use cases such as IRSA).

A possible values shape could be:
```
server:
serviceAccount:
create: true
name: authentik-server
annotations: {}
```

A less-elegant alternative it to create a `ServiceAccount` with `additionalObjects:`:
```
additionalObjects:
- apiVersion: v1
kind: ServiceAccount
metadata:
name: authentik-server
```