Authn: Support access token wildcard namespace

[kalleep]

What is this feature?
When working on documentation for grafana instance authentication using access tokens I noticed that we disallow wildcard namespace *. The point of that special namespace is to allow it for all instances.

So this pr changes that behavior only for access token. When authenticating using on behalf of a user (OBO) we still require that id token is signed with the correct namespace.

I also did some additional cleanups:

1. Validating subjects after we have parsed namespaceID instead of checking string prefixes.
2. Remove unused dependencies (user service and signing keys service)

Which issue(s) does this PR fix?:
Fixes https://github.com/grafana/identity-access-team/issues/691

Special notes for your reviewer:

Please check that:

• It works as expected from a user's perspective.
• If this is a pre-GA feature, it is behind a feature toggle.
• The docs are updated, and if this is a notable improvement, it's added to our What's New doc.

[gamab]

LGTM