[ResponseOps] change api key usage to use core instead of security plugin

[pmuellr]

From issue: #187020

The API Key service hasn't been made available from Core yet. See the task lists at #174578 . The issue specifically for APi keys seems to be: #184764

In 9.0, all the Security APIs should be accessed through Core. These things should be done before 9.0, so that backporting the future fixes doesn't become a pain.

I assume there are hits in both the alerting and actions plugins, I think they can be made at the same time.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)