Adds JTI and expiration field support for API Tokens

[derek-ho]

Description

This change adds support for expiration field (to be used to determine validity of api tokens), as well as support for generating the JTI that represents the token. To generate the JTI the existing securityTokenManager's jwtvendor logic was re-used, and new Api tokens specific dynamic config model settings were added.

• Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)
  Enhancement
• Why these changes are required?
  Support vending the token itself and expiration
• What is the old behavior before changes and new behavior after changes?
  Return dummy jti, no support for expiration

Issues Resolved

[List any issues this PR will resolve]

Is this a backport? If so, please add backport PR # and/or commits #, and remove backport-failed label from the original PR.

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.