### Description

Currently, the [`tryAuthenticateToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L458) method calls `decodeAndValidateToken` which ends up sending two `GetRequest` for the same token ID. First in [`decodeToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L602) and second in [`checkIfTokenIsValid`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L1977). The second call is unnecessary as we already fetched the access token in the first call, it's just simply dropped. We should refactor these two methods to avoid sending second get request just to validate the access token.
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
* @param listener              The listener to call upon completion with a {@link CreateTokenResult} containing the
     *                              serialized access token, serialized refresh token and authentication for which the token is created
     *                              as these will be returned to the client
     */
    private void createOAuth2Tokens(
        byte[] accessTokenBytes,
        @Nullable byte[] refreshTokenBytes,
        TransportVersion tokenVersion,
        Authentication authentication,
        Authentication originatingClientAuth,
        Map<String, Object> metadata,
        ActionListener<CreateTokenResult> listener
    ) {
        ensureEnabled();
        if (authentication == null) {
            listener.onFailure(traceLog("create token", new IllegalArgumentException("authentication must be provided")));
        } else if (originatingClientAuth == null) {
            listener.onFailure(
                traceLog("create token", new IllegalArgumentException("originating client authentication must be provided"))
            );
        } else {
            final Authentication tokenAuth = authentication.token().maybeRewriteForOlderVersion(tokenVersion);
            final String accessTokenToStore;
            final String refreshTokenToStore;
            final String refreshTokenToReturn;
            final String documentId;
            final BytesReference tokenDocument;
            try {
                final String userTokenId;
                if (tokenVersion.onOrAfter(VERSION_GET_TOKEN_DOC_FOR_REFRESH)) {