add manual check for turtle service accounts

[bkendall]

Description

Instead of checking for an error message coming back from the API, we can proactively check for service accounts and their permissions. This change adjusts the flow to be:

1. test for actAs permissions on the service account
2. create the service account (with the appropriate role) if it did not exist
3. create the backend

This should be significantly more reliable since we won't be relying on error message parsing.