Add enabled status of api key and token services to security feature set

[jaymode]

As other applications start to build features against the OAuth2 tokens and the API Keys, we should offer a way for the application to determine if these services are enabled. We already have the feature set api, which provides an easy way to expose whether these services are enabled or not.

[elasticmachine]

Pinging @elastic/es-security