Allow service account API keys to expire

### Current Behavior

API keys are created once and never expire. A leaked key remains usable until it's deleted. This is not only insecure, but also goes against industry best practice at this point.

References:

* https://owasp.github.io/www-project-non-human-identities-top-10/2025/7-long-lived-secrets/
* https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html#274-expiration

### Proposed Behavior

Allow users to specify an expiry duration for API keys.

Make this **mandatory** for keys created for [service accounts](#7055). Keep it optional for keys owned by teams to retain API backward-compatibility.

Default to a reasonable duration (e.g. 30 days) if no expiry is specified.

Ensure that trying to authenticate with an expired key leads to an audit log entry explicitly calling out the expiry as rejection reason.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested