Kibana: Idle sessions never expire

[jportner]

Kibana version: 7.x / master

Describe the bug: Idle sessions don't expire. It appears that every time the /internal/security/session API is called to check the session expiration, it renews the session.

Steps to reproduce:

1. Start Kibana with xpack.security.session.idleTimeout: "75s"
2. Observe the calls to the /internal/security/session API, and the responses each have an increasing idleTimeoutExpiration property.
3. Observe that the user's session never expires.

Expected behavior: The user's session should expire after the specified time period of inactivity.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[jportner]

Looks like the Kibana Platform changed how it handles exposing system requests to plugins. Tested and verified that this issue started after #53734 was merged.

Will submit a PR to fix shortly.

[legrego]

Thanks for finding and researching this! Gold medal for catching before it shipped 🥇