Allow operator to set expiration period for sessions and API tokens

[wfchandler]

Some organizations have policies on the maximum permissible duration for a user session.

With #2302 we are working on adding expiration for API tokens, and today the web console has a configurable session duration, but it is not exposed to operators.

An API to allow rack operators to set the expiration period for all session types would be useful for these organizations.

[david-crespo]

Session covered in #5477