Global option for limiting invite expiry time

Description:

Currently RC does not have an admin option to limit the expiry time of the channel owner created invitations.

Invitations are a good and necessary feature in an email provisioned service. But on RocketChat services that are hosted for less educated users the users often create never expiring invitations needlessly and carelessly.

Because the invitation urls are too short and simple, it is very easy for a malicious actor to arrange a long running harvest operation to find out the forgotten never expiring invite links.

It would be preferable that administrators would have a global option to disable never expiring token length from the options of the invite links.

Another solution to the same problem would be that the links would be much longer and hence harder to harvest.

Steps to reproduce:

1. Create a channel
2. Create an invite link
3. Set the expiry time to never in the invite link

Expected behavior:

It would be preferable that never expiring invite links would not be possible to create haphazardly.

Actual behavior:

Any channel owner or moderator can create never expiring invite links.

Server Setup Information:

• Version of Rocket.Chat Server: 6.5.0
• Operating System: RHEL8
• Deployment Method: tar
• Number of Running Instances: 10
• DB Replicaset Oplog: Yes
• NodeJS Version: 14.21.3
• MongoDB Version: 5.0

Client Setup Information

• Desktop App or Browser Version: any

Additional context

A workaround for this problem is to clean up the database of any never expiring links using scripts. Or by deleting them manually under Administrator -> Invites.

Start by tracing channel invite creation and the Administrator → Invites area described in the issue, then identify where invite expiry choices and global settings are handled. Define the administrator-controlled maximum expiry, prevent channel owners and moderators from creating links beyond it, and add coverage showing that never-expiring links are blocked when the limit is configured.