### Description

Currently, the [`tryAuthenticateToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L458) method calls `decodeAndValidateToken` which ends up sending two `GetRequest` for the same token ID. First in [`decodeToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L602) and second in [`checkIfTokenIsValid`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L1977). The second call is unnecessary as we already fetched the access token in the first call, it's just simply dropped. We should refactor these two methods to avoid sending second get request just to validate the access token.
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
* and return an access token and refresh token based on that. Otherwise this token document gets its refresh_token marked as refreshed,
     * while also storing the Instant when it was refreshed along with a pointer to the new token document that holds the refresh_token that
     * supersedes this one. The new document that contains the new access token and refresh token is created and finally the new access
     * token and refresh token are returned to the listener.
     */
    private void innerRefresh(
        String refreshToken,
        Doc tokenDoc,
        Authentication clientAuth,
        Iterator<TimeValue> backoff,
        Instant refreshRequested,
        ActionListener<CreateTokenResult> listener
    ) {
        logger.debug("Attempting to refresh token stored in token document [{}]", tokenDoc.id());
        final Consumer<Exception> onFailure = ex -> listener.onFailure(traceLog("refresh token", tokenDoc.id(), ex));
        final Tuple<RefreshTokenStatus, Optional<ElasticsearchSecurityException>> checkRefreshResult;
        try {
            checkRefreshResult = checkTokenDocumentForRefresh(refreshRequested, clientAuth, tokenDoc.sourceAsMap());
        } catch (DateTimeException | IllegalStateException e) {
            onFailure.accept(new ElasticsearchSecurityException("invalid token document", e));
            return;
        }
        if (checkRefreshResult.v2().isPresent()) {
            onFailure.accept(checkRefreshResult.v2().get());
            return;
        }
        final RefreshTokenStatus refreshTokenStatus = checkRefreshResult.v1();
        final SecurityIndexManager refreshedTokenIndex = getTokensIndexForVersion(refreshTokenStatus.getTransportVersion());
        if (refreshTokenStatus.isRefreshed()) {
            logger.debug(