UAMI accounts will not have oidc email field populated through token, need to be dynamically built
Needed if Thurloe is running as an UAMI and needs service account admin whitelist

Swapped boolean logic to allow if either condition is true as opposed to reject if both conditions are false
Added helper function to verify email oidcHeader is empty to clean up logic in route slightly and remove edge case of [email protected] being a potentially valid value in serviceAccountAdmin configuration