### Description

The [Get API key information API](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-api-get-api-key.html) can currently filter the returned keys by:
 * key id/name
 * keys owned by the calling user
 * keys owned by other users, by `realm_name` and `username`

Irrespective of the filtering used, both invalidated and expired (but not yet deleted) keys will be included in the response.
In the response, keys have the `invalidated` boolean property, as well as the `expiration` property that contains the UNIX timestamp past of which the key is no longer valid for authentication.

I propose we introduce a way for the API to support retrieving:
* only valid API keys (not return invalidated keys) - using a boolean request parameter
* keys not expired before a certain timestamp - using a timestamp parameter that defaults to "now" - also note that keys' experiation date is always checked against the local node's clock
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ApiKeyServiceTests.java
final SecurityContext securityContext = new SecurityContext(Settings.EMPTY, threadContext);
            authenticationContextSerializer.writeToContext(
                Authentication.newApiKeyAuthentication(authenticationResult, "node01"),
                threadContext
            );
            final CompletableFuture<Authentication> authFuture = new CompletableFuture<>();
            securityContext.executeAfterRewritingAuthentication((c) -> {
                try {
                    authFuture.complete(authenticationContextSerializer.readFromContext(threadContext));
                } catch (IOException e) {
                    throw new RuntimeException(e);
                }
            }, version);
            return authFuture.get();
        }
        public static Authentication createApiKeyAuthentication(ApiKeyService apiKeyService, Authentication authentication)
            throws Exception {
            return createApiKeyAuthentication(
                apiKeyService,
                authentication,
                Collections.singleton(new RoleDescriptor("user_role_" + randomAlphaOfLength(4), new String[] { "manage" }, null, null)),
                null,
                TransportVersion.current()
            );
        }
    }
    private ApiKeyService createApiKeyService() {
        final Settings settings = Settings.builder().put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true).build();
        return createApiKeyService(settings);
    }