[6/n] add getServiceToken for LLM actions (#55241)

Adds `getServiceToken` to `convex/server`. An action calls it to get a short-lived credential for a Convex-managed service, and sends it to the gateway as a bearer token.

```ts
import { getServiceToken } from "convex/server";

const token = await getServiceToken("ai");
```

`"ai"` is the only supported service as of now. Calling it outside an action throws.

GitOrigin-RevId: feaf321ce5c8d6adc035a71c3e6e372a30350cbd