### Description

Currently, the [`tryAuthenticateToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L458) method calls `decodeAndValidateToken` which ends up sending two `GetRequest` for the same token ID. First in [`decodeToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L602) and second in [`checkIfTokenIsValid`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L1977). The second call is unnecessary as we already fetched the access token in the first call, it's just simply dropped. We should refactor these two methods to avoid sending second get request just to validate the access token.
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
final byte[] bytes = refreshToken.getBytes(StandardCharsets.UTF_8);
            try (StreamInput in = new InputStreamStreamInput(Base64.getDecoder().wrap(new ByteArrayInputStream(bytes)), bytes.length)) {
                final TransportVersion version = TransportVersion.readVersion(in);
                in.setTransportVersion(version);
                if (version.onOrAfter(VERSION_GET_TOKEN_DOC_FOR_REFRESH)) {
                    final byte[] refreshTokenBytes = in.readByteArray();
                    if (refreshTokenBytes.length != RAW_TOKEN_BYTES_TOTAL_LENGTH) {
                        logger.debug(
                            "Refresh token with version [{}] has length [{}] but expect length is [{}].",
                            version,
                            refreshTokenBytes.length,
                            RAW_TOKEN_BYTES_LENGTH
                        );
                        listener.onResponse(null);
                    } else {
                        MessageDigest userTokenIdDigest = sha256();
                        userTokenIdDigest.update(refreshTokenBytes, RAW_TOKEN_BYTES_LENGTH, RAW_TOKEN_DOC_ID_BYTES_LENGTH);
                        final String userTokenId = Base64.getUrlEncoder().withoutPadding().encodeToString(userTokenIdDigest.digest());
                        final String storedRefreshToken = Base64.getUrlEncoder()
                            .withoutPadding()
                            .encodeToString(sha256().digest(refreshTokenBytes));
                        getTokenDocById(userTokenId, version, null, storedRefreshToken, listener);
                    }
                } else if (version.onOrAfter(VERSION_HASHED_TOKENS)) {
                    final String unencodedRefreshToken = in.readString();
                    if (unencodedRefreshToken.length() != TOKEN_LENGTH) {
                        logger.debug("Decoded refresh token [{}] with version [{}] is invalid.", unencodedRefreshToken, version);
                        listener.onResponse(null);
                    } else {
                        final String hashedRefreshToken = hashTokenString(unencodedRefreshToken);