Introduced the COMM_SERVICES_DISABLE_CSAT_VERIFICATION env var flag that lets us skip
token verification for services.

Needed to replace built-in BearerAuth middleware extractor with a custom one, that
allows Authorization header to be optional. By the way, gained converting header value
into our AuthorizationCredential type for free.

Depends on D12411

Tested more deeply in further diffs. At this point, wrapped Blob service endpoints with the middleware:

• With env var set, request succeeded with and without Authorization header
• Without the env var, HTTP 401 was returned if header was not provided or was malformed.

At this point, only header format is validated, credentials may be invalid