### Description

The [Get API key information API](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-api-get-api-key.html) can currently filter the returned keys by:
 * key id/name
 * keys owned by the calling user
 * keys owned by other users, by `realm_name` and `username`

Irrespective of the filtering used, both invalidated and expired (but not yet deleted) keys will be included in the response.
In the response, keys have the `invalidated` boolean property, as well as the `expiration` property that contains the UNIX timestamp past of which the key is no longer valid for authentication.

I propose we introduce a way for the API to support retrieving:
* only valid API keys (not return invalidated keys) - using a boolean request parameter
* keys not expired before a certain timestamp - using a timestamp parameter that defaults to "now" - also note that keys' experiation date is always checked against the local node's clock
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ApiKeyServiceTests.java
doAnswer(invocationOnMock -> {
            hashCounter.incrementAndGet();
            hashWait.acquire();
            return invocationOnMock.callRealMethod();
        }).when(service).verifyKeyAgainstHash(any(String.class), any(ApiKeyCredentials.class), anyActionListener());
        final String apiKeyId = randomAlphaOfLength(12);
        final PlainActionFuture<AuthenticationResult<User>> future1 = new PlainActionFuture<>();
        
        mockSourceDocument(apiKeyId, sourceMap);
        
        this.threadPool.generic()
            .execute(() -> service.tryAuthenticate(threadPool.getThreadContext(), getApiKeyCredentials(apiKeyId, apiKey, type), future1));
        
        assertBusy(() -> assertThat(hashCounter.get(), equalTo(1)));
        if (future1.isDone()) {
            
            fail("Expected authentication to be blocked, but was " + future1.actionGet());
        }
        
        PlainActionFuture<AuthenticationResult<User>> future2 = new PlainActionFuture<>();
        service.tryAuthenticate(threadPool.getThreadContext(), getApiKeyCredentials(apiKeyId, apiKey, type), future2);
        assertThat(hashCounter.get(), equalTo(1));
        if (future2.isDone()) {
            
            fail("Expected authentication to be blocked, but was " + future2.actionGet());
        }
        hashWait.release();
        final AuthenticationResult<User> authResult1 = future1.actionGet(TimeValue.timeValueSeconds(2));
        assertThat(authResult1.isAuthenticated(), is(true));
        checkAuthApiKeyMetadata(metadata, authResult1);