Users with only `manage_own_api_key` privilege is not allowed to use the [GrantApiKey API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-grant-api-key.html#security-api-grant-api-key). The overall behaviour is correctly implemented but the error message could use some improvements. Currently it is something like the follows:

```
POST _security/api_key/grant
{
  "password": "password",
  "grant_type": "password",
  "username": "foo",
  "api_key": {
    "name": "k1"
  }
}

===
{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "manage own api key privilege only supports API key requests (not org.elasticsearch.xpack.core.security.action.apikey.GrantApiKeyRequest)"
  },
  "status": 400
}
```

This is different from other unauthorized error messages which should be along the line of 
> action [..] is unauthorized for user [...] with roles [...], this action is granted by ..

The status code should also be `403` instead of `400`.
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/ManageOwnApiKeyClusterPrivilegeTests.java
final ClusterPermission clusterPermission = ManageOwnApiKeyClusterPrivilege.INSTANCE.buildPermission(ClusterPermission.builder())
            .build();
        final boolean isRunAs = randomBoolean();
        final User userJoe = new User("joe");
        final Authentication.RealmRef realmRef = new Authentication.RealmRef("realm1", "realm1", randomAlphaOfLengthBetween(3, 8));
        final Authentication authentication;
        if (isRunAs) {
            final User runByUser = new User("not-joe");
            if (randomBoolean()) {
                authentication = Authentication.newRealmAuthentication(runByUser, realmRef).runAs(userJoe, realmRef);
            } else {
                authentication = AuthenticationTests.randomApiKeyAuthentication(runByUser, randomAlphaOfLength(20))
                    .runAs(userJoe, realmRef);
            }
        } else {
            authentication = AuthenticationTests.randomAuthentication(userJoe, realmRef);
        }
        final TransportRequest getApiKeyRequest = GetApiKeyRequest.forOwnedApiKeys();
        final TransportRequest invalidateApiKeyRequest = InvalidateApiKeyRequest.forOwnedApiKeys();
        assertTrue(clusterPermission.check("cluster:admin/xpack/security/api_key/get", getApiKeyRequest, authentication));
        assertTrue(clusterPermission.check("cluster:admin/xpack/security/api_key/invalidate", invalidateApiKeyRequest, authentication));
        assertFalse(clusterPermission.check("cluster:admin/something", mock(TransportRequest.class), authentication));
    }
    public void testAuthenticationWithUserDeniesAccessToApiKeyActionsWhenItIsNotOwner() {
        final ClusterPermission clusterPermission = ManageOwnApiKeyClusterPrivilege.INSTANCE.buildPermission(ClusterPermission.builder())
            .build();
        final boolean isRunAs = randomBoolean();
        final User userJoe = new User("joe");
        final Authentication.RealmRef realmRef = new Authentication.RealmRef("realm1", "realm1", randomAlphaOfLengthBetween(3, 8));
        final Authentication authentication;