Use path name for service account updates

[fallintoplace]

Summary

• make service account updates look up the resource by the URL path name
• reject requests where the JSON body name points at a different service account
• add controller regressions for mismatched and matching update requests

Testing

• go test ./internal/controller
• go test -run '^$' ./...