Invalidate tokens API

[jkakavas]

Today the only way for invalidating an authentication token is to invoke the delete token API passing in the string representation of the token that should be invalidated.

We should offer more granular ways for users to perform token invalidation in order to support use cases such as user expiration or protection from user credentials exposure.
For example, we should be allowing users to:

• Invalidate all tokens for a specific realm of given type
• Invalidate all tokens for a specific user principal across all realms
• Invalidate all tokens created before or after a specific instant (?)
• Invalidate all tokens

[elasticmachine]

Pinging @elastic/es-security

[jkakavas]

This is implemented in #35388, #36766, #36362, #36787, #36893