📝 Description

This pull request introduces enhancements and fixes related to authentication and service account token handling in the MLRun framework.

🛠️ Changes Made

• Introduced a Claims class for JWT claims constants in mlrun/auth/utils.py.
• Added is_token_expired and _decode_token_unverified utility functions for JWT token handling.
• Added a new igz_authenticator_kind header constant in mlrun/common/schemas/constants.py.
• Introduced a service_account configuration section in mlrun/config.py for Kubernetes service account tokens.
• Created a new service_account_token.py client for managing service account tokens.
• Updated Iguazio client logic to use the service account token for escalated requests.
• Added unit tests for the service_account_token.py client.
• Enhanced existing tests in test_auth_utils.py to cover token expiration scenarios.
• Made the delete project alerts functionality escalate to the service account token in case the project permissions are already removed

✅ Checklist

• I have tested the changes in this PR

🧪 Testing

• Added unit tests for the service_account_token.py client to validate token caching, expiration handling, and header escalation.
• Added unit tests in test_auth_utils.py to cover token expiration and missing claims scenarios.
• Verified changes manually in a Kubernetes environment to ensure proper handling of service account tokens.

🔗 References

• Ticket link: https://iguazio.atlassian.net/browse/ML-11618

🚨 Breaking Changes?

• Yes (explain below)
• No

🔍️ Additional Notes

• Known issue: The create_default_project_policies method currently relies on incoming request auth info. Future updates to the Iguazio API are required to support explicit owner parameters.