Stan Hu authored Jul 16, 2024 and Imre Farkas committed Jul 26, 2024

If `require_personal_access_token_expiry?` is `false`, we allow for a
`nil` expires_at if no parameter is passed in the API instead of
defaulting to a 1-week expiration.

If the token is owned by service account, the
`service_access_tokens_expiration_enforced` setting is checked to
determine whether to skip the 1-week default.

We also ensure that the expiration is within the max allowed lifetime
set by the instance or group.