Add ApiKey expiration time to audit log

[jfreden]

Follow up to PR: #103453

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)

[elasticsearchmachine]

Hi @jfreden, I've created a changelog YAML for you.

[n1v0lg]

LGTM, sorry for the delay!

For this one, we can go with a Security/Audit label. Also, two follow ups, one related to audit logging, other generically to the addition of the new field (forgot about this one before):

• We should update audit event docs: https://www.elastic.co/guide/en/elasticsearch/reference/current/audit-event-types.html (under change_apikey and other event types where it matters) to reflect the new field
• We might need to update the API spec -- this is used to generate ES client definitions. See this PR for an example: Add active_only flag definition to Get API key spec elasticsearch-specification#2371

[jfreden]

Thanks for the review!

We should update audit event docs: https://www.elastic.co/guide/en/elasticsearch/reference/current/audit-event-types.html (under change_apikey and other event types where it matters) to reflect the new field

Added it to this PR.

We might need to update the API spec -- this is used to generate ES client definitions. See this PR for an example: elastic/elasticsearch-specification#2371

Will work on a separate PR for this.