ci: fix test-token-without-serviceaccount-succeeds rules