Allow forcing a limit on api keys

[wolframhaussig]

Currently, the expiration of api keys can be provided at creation time. If the expiration is not provided the api key will never expire:

By default, API keys never expire. You can specify expiration information when you create the API keys.

Similiar to this password strength issue and the token setting xpack.security.authc.token.timeout I would like to have the option to specify the maximum lifetime of an api key:
If the administrator sets xpack.security.authc.api_key.expiration to 180d and the user does not provide an expiration date when creating the api key the resulting api key will expire after 180 days.
If the administrator sets xpack.security.authc.api_key.expiration to 180d and the user provides an expiration date of 30d when creating the api key the resulting api key will expire after 30 days.
If the administrator sets xpack.security.authc.api_key.expiration to 180d and the user provides an expiration date of 365d when creating the api key the creation should fail with an error.

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[tvernum]

It is unlikely that we will do this with a global setting.
Features such as Kibana Alerting and Actions and Fleet depend on API Keys and would be significantly complicated if they needed to accommodate such local policies.

We might at some future time, expand the existing RBAC model to support individual restrictions on API Key expiry, but it's not on our roadmap right now.