Administrator access via unchecked service-account role update

Privilege escalation in SkyPilot 0.13.1rc1 and earlier allows remote authenticated users to gain administrator access via service-account role updates. The POST /users/service-account-tokens/update-role handler checks only whether the caller owns the token and then writes the requested role without verifying that the caller is an admin permitted to grant it. On multi-user API servers with service accounts enabled, any non-admin user can create a service account, promote it, and use its bearer token to administer all users and workspaces.