Invalidation of API key's fails using service token

[blakerouse]

At the moment the invalidation of API keys from the UNENROLL ACK fails only when using the service token for authentication with elasticsearch.

The client.Security.InvalidateAPIKey needs to send owner: true in the request body, or elasticsearch will response with a permission error.

This relates to elastic/beats#25773 and elastic/elasticsearch#73278

[ph]

Adding more context, we have been testing initially with the fleet_enroll user which has different permissions than the service token. The major difference is manage_api_key vs manage_own_api_key used by the service token. When this permission is used you absolutely need to send owner: true when doing the invalidation call if not Elasticsearch will refuse to do the operation.

We initially thought it was more a flakiness than a permission issue, but when investigating more we have found that the problem was actually when invalidating the key.

We also need to understand why this is not caugh in our end 2 end testing environment.