### CI Link

https://gradle-enterprise.elastic.co/s/bhuomrfypovuq

### Repro line

gradlew :x-pack:plugin:security:test --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17

### Does it reproduce?

Yes

### Applicable branches

main

### Failure history

_No response_

### Failure excerpt

```
  2> REPRODUCE WITH: ./gradlew ':x-pack:plugin:security:test' --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17
  2> java.lang.ClassCastException: class java.util.HashMap cannot be cast to class org.elasticsearch.common.bytes.BytesReference (java.util.HashMap is in module java.base of loader 'bootstrap'; org.elasticsearch.common.bytes.BytesReference is in unnamed module of loader 'app')
        at __randomizedtesting.SeedInfo.seed([819240371E8B1C23:50D848AB4705CC]:0)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadataForApiKeyRoleDescriptors(Authentication.java:1093)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadata(Authentication.java:271)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteForOlderVersion(Authentication.java:232)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.buildUserToken(TokenServiceTests.java:941)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated(TokenServiceTests.java:437)
```
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java
private static Map<String, Object> maybeRewriteMetadata(TransportVersion olderVersion, Authentication authentication) {
        if (authentication.isAuthenticatedAsApiKey()) {
            return maybeRewriteMetadataForApiKeyRoleDescriptors(olderVersion, authentication);
        } else if (authentication.isRemoteAccess()) {
            return maybeRewriteMetadataForRemoteAccessAuthentication(olderVersion, authentication);
        } else {
            return authentication.getAuthenticatingSubject().getMetadata();
        }
    }
    /**
     * Returns a new {@code Authentication} that reflects a "run as another user" action under the current {@code Authentication}.
     * The security {@code RealmRef#Domain} of the resulting {@code Authentication} is that of the run-as user's realm.
     *
     * @param runAs The user to be impersonated
     * @param lookupRealmRef The realm where the impersonated user is looked up from. It can be null if the user does
     *                       not exist. The null lookup realm is used to indicate the lookup failure which will be rejected
     *                       at authorization time.
     */
    public Authentication runAs(User runAs, @Nullable RealmRef lookupRealmRef) {
        assert supportsRunAs(null);
        assert false == runAs instanceof AnonymousUser;
        assert false == hasSyntheticRealmNameOrType(lookupRealmRef) : "should not use synthetic realm name/type for lookup realms";
        Objects.requireNonNull(runAs);
        return new Authentication(
            new Subject(runAs, lookupRealmRef, getEffectiveSubject().getTransportVersion(), Map.of()),
            authenticatingSubject,
            type
        );
    }
    /** Returns a new {@code Authentication} for tokens created by the current {@code Authentication}, which is used when