Fix optional params for deploy token API

What does this MR do?

Closes #211878 (closed) for the project and group deploy token API.

The username and expires_at attributes are optional (as currently described in the docs and in the UI behavior), but they were added in 12.9 as required for both API endpoints.

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

Not sure if any additional tests should be added or changed; the original tests supply all attributes though.
See https://gitlab.com/gitlab-org/gitlab/-/blob/9add2593c5542812d745a8d0e45700a7940e35d2/spec/requests/api/deploy_tokens_spec.rb