### Description

Currently, the [`tryAuthenticateToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L458) method calls `decodeAndValidateToken` which ends up sending two `GetRequest` for the same token ID. First in [`decodeToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L602) and second in [`checkIfTokenIsValid`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L1977). The second call is unnecessary as we already fetched the access token in the first call, it's just simply dropped. We should refactor these two methods to avoid sending second get request just to validate the access token.
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
if (userTokenSource == null || userTokenSource.isEmpty()) {
            throw new IllegalStateException("token document is missing the user token info");
        }
        return userTokenSource;
    }
    /**
     * Checks if the token can be refreshed once more. If a token has previously been refreshed, it can only by refreshed again inside a
     * short span of time (30 s).
     *
     * @return An {@code Optional} containing the exception in case this refresh token cannot be reused, or an empty <b>Optional</b> if
     *         refreshing is allowed.
     */
    private static Optional<ElasticsearchSecurityException> checkMultipleRefreshes(
        Instant refreshRequested,
        RefreshTokenStatus refreshTokenStatus
    ) {
        if (refreshTokenStatus.isRefreshed()) {
            if (refreshTokenStatus.getTransportVersion().onOrAfter(VERSION_MULTIPLE_CONCURRENT_REFRESHES)) {
                if (refreshRequested.isAfter(refreshTokenStatus.getRefreshInstant().plus(30L, ChronoUnit.SECONDS))) {
                    return Optional.of(invalidGrantException("token has already been refreshed more than 30 seconds in the past"));
                }
                if (refreshRequested.isBefore(refreshTokenStatus.getRefreshInstant().minus(30L, ChronoUnit.SECONDS))) {
                    return Optional.of(
                        invalidGrantException("token has been refreshed more than 30 seconds in the future, clock skew too great")
                    );
                }
            } else {
                return Optional.of(invalidGrantException("token has already been refreshed"));
            }
        }