### Description

The [Get API key information API](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-api-get-api-key.html) can currently filter the returned keys by:
 * key id/name
 * keys owned by the calling user
 * keys owned by other users, by `realm_name` and `username`

Irrespective of the filtering used, both invalidated and expired (but not yet deleted) keys will be included in the response.
In the response, keys have the `invalidated` boolean property, as well as the `expiration` property that contains the UNIX timestamp past of which the key is no longer valid for authentication.

I propose we introduce a way for the API to support retrieving:
* only valid API keys (not return invalidated keys) - using a boolean request parameter
* keys not expired before a certain timestamp - using a timestamp parameter that defaults to "now" - also note that keys' experiation date is always checked against the local node's clock
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/ApiKeyService.java
final BaseBulkUpdateApiKeyRequest request,
        final Set<RoleDescriptor> userRoleDescriptors,
        final Collection<VersionedApiKeyDoc> targetVersionedDocs,
        final ActionListener<BulkUpdateApiKeyResponse> listener
    ) {
        logger.trace("Found [{}] API keys of [{}] requested for update", targetVersionedDocs.size(), request.getIds().size());
        assert targetVersionedDocs.size() <= request.getIds().size()
            : "more docs were found for update than were requested. found: "
                + targetVersionedDocs.size()
                + " requested: "
                + request.getIds().size();
        final BulkUpdateApiKeyResponse.Builder responseBuilder = BulkUpdateApiKeyResponse.builder();
        final BulkRequestBuilder bulkRequestBuilder = client.prepareBulk();
        for (VersionedApiKeyDoc versionedDoc : targetVersionedDocs) {
            final String apiKeyId = versionedDoc.id();
            try {
                validateForUpdate(apiKeyId, request.getType(), authentication, versionedDoc.doc());
                final IndexRequest indexRequest = maybeBuildIndexRequest(versionedDoc, authentication, request, userRoleDescriptors);
                final boolean isNoop = indexRequest == null;
                if (isNoop) {
                    logger.debug("Detected noop update request for API key [{}]. Skipping index request", apiKeyId);
                    responseBuilder.noop(apiKeyId);
                } else {
                    bulkRequestBuilder.add(indexRequest);
                }
            } catch (Exception ex) {
                responseBuilder.error(apiKeyId, traceLog("prepare index request for update", ex));
            }
        }
        addErrorsForNotFoundApiKeys(responseBuilder, targetVersionedDocs, request.getIds());