Users with only `manage_own_api_key` privilege is not allowed to use the [GrantApiKey API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-grant-api-key.html#security-api-grant-api-key). The overall behaviour is correctly implemented but the error message could use some improvements. Currently it is something like the follows:

```
POST _security/api_key/grant
{
  "password": "password",
  "grant_type": "password",
  "username": "foo",
  "api_key": {
    "name": "k1"
  }
}

===
{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
  },
  "status": 400
}
```

This is different from other unauthorized error messages which should be along the line of 
> action [..] is unauthorized for user [...] with roles [...], this action is granted by ..

The status code should also be `403` instead of `400`.
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/ManageOwnApiKeyClusterPrivilege.java
return false;
                } else if (ownedByAuthenticatedUser) {
                    return true;
                } else if (Strings.hasText(username) && Strings.hasText(realmName)) {
                    if (false == username.equals(authentication.getUser().principal())) {
                        return false;
                    }
                    RealmDomain domain = authentication.getSourceRealm().getDomain();
                    if (domain != null) {
                        return domain.realms().stream().anyMatch(realmIdentifier -> realmName.equals(realmIdentifier.getName()));
                    } else {
                        return realmName.equals(authentication.getSourceRealm().getName());
                    }
                }
            }
            return false;
        }
        private static boolean isCurrentAuthenticationUsingSameApiKeyIdFromRequest(Authentication authentication, String apiKeyId) {
            if (authentication.isApiKey()) {
                
                final String authenticatedApiKeyId = (String) authentication.getMetadata().get(AuthenticationField.API_KEY_ID_KEY);
                if (Strings.hasText(apiKeyId)) {
                    return apiKeyId.equals(authenticatedApiKeyId);
                }
            }
            return false;
        }
    }
}