### CI Link

https://gradle-enterprise.elastic.co/s/mcboq4te6p7o6

### Repro line

./gradlew :plugins:discovery-gce:qa:gce:check -Dtests.fips.enabled=true

### Does it reproduce?

Yes

### Applicable branches

master

### Failure history

_No response_

### Failure excerpt

This seems to have started failing since #85132

```
[2022-04-12T17:07:29,829][WARN ][o.e.c.g.GceInstancesServiceImpl] [yamlRestTest-1] unable to resolve default zone from metadata server for GCE discovery service
  java.security.KeyStoreException: Uninitialized keystore
       at java.security.KeyStore.size(KeyStore.java:1296) ~[?:?]
       at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.getTrustAnchors(ProvTrustManagerFactorySpi.java:227) ~[bctls-fips-1.0.9.jar:1.0.9]
       at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.engineInit(ProvTrustManagerFactorySpi.java:163) ~[bctls-fips-1.0.9.jar:1.0.9]
       at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:282) ~[?:?]
       at com.google.api.client.util.SslUtils.initSslContext(SslUtils.java:107) ~[google-http-client-1.41.1.jar:1.41.1]
```
plugins/discovery-gce/src/main/java/org/elasticsearch/cloud/gce/GceInstancesServiceImpl.java
if (logger.isTraceEnabled()) logger.trace("using cache to retrieve client");
                return client;
            }
            lastRefresh = System.currentTimeMillis();
        }
        try {
            gceJsonFactory = new JacksonFactory();
            logger.info("starting GCE discovery service");
            
            
            
            String tokenServerEncodedUrl = GceMetadataService.GCE_HOST.get(settings)
                + "/computeMetadata/v1/instance/service-accounts/default/token";
            ComputeCredential credential = new ComputeCredential.Builder(getGceHttpTransport(), gceJsonFactory).setTokenServerEncodedUrl(
                tokenServerEncodedUrl
            ).build();
            
            
            Access.doPrivilegedIOException(credential::refreshToken);
            logger.debug("token [{}] will expire in [{}] s", credential.getAccessToken(), credential.getExpiresInSeconds());
            if (credential.getExpiresInSeconds() != null) {
                refreshInterval = TimeValue.timeValueSeconds(credential.getExpiresInSeconds() - 1);
            }
            Compute.Builder builder = new Compute.Builder(getGceHttpTransport(), gceJsonFactory, null).setApplicationName(VERSION)
                .setRootUrl(GCE_ROOT_URL.get(settings));
            if (RETRY_SETTING.exists(settings)) {
                TimeValue maxWait = MAX_WAIT_SETTING.get(settings);
                RetryHttpInitializerWrapper retryHttpInitializerWrapper;
                if (maxWait.getMillis() > 0) {
                    retryHttpInitializerWrapper = new RetryHttpInitializerWrapper(credential, maxWait);