KEYCLOAK-3391 Better control of service account roles tab visibility

Previously the service account roles remain visible when changing
the client type from confidential to public or bearer only.

We now only show the service account roles tab iif:
- service accounts are enabled
- client access type is set to confidential

themes/src/main/resources/theme/base/admin/resources/templates/kc-tabs-client.html

@@ -39,7 +39,7 @@
             <kc-tooltip>{{:: 'installation.tooltip' | translate}}</kc-tooltip>
         </li>
 
-        <li ng-class="{active: path[4] == 'service-account-roles'}" data-ng-show="client.serviceAccountsEnabled">
+        <li ng-class="{active: path[4] == 'service-account-roles'}" data-ng-show="client.serviceAccountsEnabled && !(client.bearerOnly || client.publicClient)">
             <a href="#/realms/{{realm.realm}}/clients/{{client.id}}/service-account-roles">{{:: 'service-account-roles' | translate}}</a>
             <kc-tooltip>{{:: 'service-account-roles.tooltip' | translate}}</kc-tooltip>
         </li>