Correct format for token expiration time

Tokens with expiration time limited by application credentials had an
incorrect format.

Fix the format, control it with the test.

Closes-Bug: 2075723
Change-Id: I09fe34541615090766a5c4a010a3f39756debedc

keystone/tests/unit/test_v3_auth.py

@@ -6411,6 +6411,7 @@ class ApplicationCredentialAuth(test_v3.RestfulTestCase):
         resp = self.v3_create_token(
             auth_data, expected_status=http.client.CREATED
         )
+        self.assertValidTokenResponse(resp)
         token = resp.headers.get('X-Subject-Token')
         future = datetime.datetime.utcnow() + datetime.timedelta(minutes=2)
         with freezegun.freeze_time(future):

keystone/token/provider.py

@@ -316,11 +316,13 @@ class Manager(manager.Manager):
             if (app_cred['expires_at'] is not None) and (
                 token_time > app_cred['expires_at']
             ):
-                token.expires_at = app_cred['expires_at'].isoformat()
+                token.expires_at = utils.isotime(
+                    app_cred['expires_at'], subsecond=True
+                )
                 LOG.debug(
                     'Resetting token expiration to the application'
                     ' credential expiration: %s',
-                    app_cred['expires_at'].isoformat(),
+                    token.expires_at,
                 )
 
         token_id, issued_at = self.driver.generate_id_and_issued_at(token)