Users with only `manage_own_api_key` privilege is not allowed to use the [GrantApiKey API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-grant-api-key.html#security-api-grant-api-key). The overall behaviour is correctly implemented but the error message could use some improvements. Currently it is something like the follows:

```
POST _security/api_key/grant
{
  "password": "password",
  "grant_type": "password",
  "username": "foo",
  "api_key": {
    "name": "k1"
  }
}

===
{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
  },
  "status": 400
}
```

This is different from other unauthorized error messages which should be along the line of 
> action [..] is unauthorized for user [...] with roles [...], this action is granted by ..

The status code should also be `403` instead of `400`.
x-pack/plugin/security/qa/security-trial/src/javaRestTest/java/org/elasticsearch/xpack/security/apikey/ApiKeyRestIT.java
private static final String SYSTEM_USER = "system_user";
    private static final SecureString SYSTEM_USER_PASSWORD = new SecureString("system-user-password".toCharArray());
    private static final String END_USER = "end_user";
    private static final SecureString END_USER_PASSWORD = new SecureString("end-user-password".toCharArray());
    @Before
    public void createUsers() throws IOException {
        createUser(SYSTEM_USER, SYSTEM_USER_PASSWORD, List.of("system_role"));
        createRole("system_role", Set.of("grant_api_key"));
        createUser(END_USER, END_USER_PASSWORD, List.of("user_role"));
        createRole("user_role", Set.of("monitor"));
    }
    @After
    public void cleanUp() throws IOException {
        deleteUser("system_user");
        deleteUser("end_user");
        deleteRole("system_role");
        deleteRole("user_role");
        invalidateApiKeysForUser(END_USER);
    }
    @SuppressWarnings({ "unchecked" })
    public void testAuthenticateResponseApiKey() throws IOException {
        final String expectedApiKeyName = "my-api-key-name";
        final Map<String, String> expectedApiKeyMetadata = Map.of("not", "returned");