Users with only `manage_own_api_key` privilege is not allowed to use the [GrantApiKey API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-grant-api-key.html#security-api-grant-api-key). The overall behaviour is correctly implemented but the error message could use some improvements. Currently it is something like the follows:

```
POST _security/api_key/grant
{
  "password": "password",
  "grant_type": "password",
  "username": "foo",
  "api_key": {
    "name": "k1"
  }
}

===
{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
  },
  "status": 400
}
```

This is different from other unauthorized error messages which should be along the line of 
> action [..] is unauthorized for user [...] with roles [...], this action is granted by ..

The status code should also be `403` instead of `400`.
x-pack/plugin/security/qa/security-trial/src/javaRestTest/java/org/elasticsearch/xpack/security/apikey/ApiKeyRestIT.java
final Map<String, Object> createApiKeyRequestBody = Map.of("name", expectedApiKeyName, "metadata", expectedApiKeyMetadata);
        final Request createApiKeyRequest = new Request("POST", "_security/api_key");
        createApiKeyRequest.setJsonEntity(XContentTestUtils.convertToXContent(createApiKeyRequestBody, XContentType.JSON).utf8ToString());
        final Response createApiKeyResponse = adminClient().performRequest(createApiKeyRequest);
        final Map<String, Object> createApiKeyResponseMap = responseAsMap(createApiKeyResponse); 
        final String actualApiKeyId = (String) createApiKeyResponseMap.get("id");
        final String actualApiKeyName = (String) createApiKeyResponseMap.get("name");
        final String actualApiKeyEncoded = (String) createApiKeyResponseMap.get("encoded"); 
        assertThat(actualApiKeyId, not(emptyString()));
        assertThat(actualApiKeyName, equalTo(expectedApiKeyName));
        assertThat(actualApiKeyEncoded, not(emptyString()));
        final Request authenticateRequest = new Request("GET", "_security/_authenticate");
        authenticateRequest.setOptions(
            authenticateRequest.getOptions().toBuilder().addHeader("Authorization", "ApiKey " + actualApiKeyEncoded)
        );
        final Response authenticateResponse = client().performRequest(authenticateRequest);
        assertOK(authenticateResponse);
        final Map<String, Object> authenticate = responseAsMap(authenticateResponse); 
        
        
        assertThat(authenticate, hasEntry("api_key", Map.of("id", actualApiKeyId, "name", expectedApiKeyName)));
    }
    public void testGrantApiKeyForOtherUserWithPassword() throws IOException {
        Request request = new Request("POST", "_security/api_key/grant");
        request.setOptions(
            RequestOptions.DEFAULT.toBuilder()
                .addHeader("Authorization", UsernamePasswordToken.basicAuthHeaderValue(SYSTEM_USER, SYSTEM_USER_PASSWORD))
        );
        final Map<String, Object> requestBody = Map.ofEntries(
            Map.entry("grant_type", "password"),