### CI Link

https://gradle-enterprise.elastic.co/s/bhuomrfypovuq

### Repro line

gradlew :x-pack:plugin:security:test --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17

### Does it reproduce?

Yes

### Applicable branches

main

### Failure history

_No response_

### Failure excerpt

```
  2> REPRODUCE WITH: ./gradlew ':x-pack:plugin:security:test' --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17
  2> java.lang.ClassCastException: class java.util.HashMap cannot be cast to class org.elasticsearch.common.bytes.BytesReference (java.util.HashMap is in module java.base of loader 'bootstrap'; org.elasticsearch.common.bytes.BytesReference is in unnamed module of loader 'app')
        at __randomizedtesting.SeedInfo.seed([819240371E8B1C23:50D848AB4705CC]:0)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadataForApiKeyRoleDescriptors(Authentication.java:1093)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadata(Authentication.java:271)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteForOlderVersion(Authentication.java:232)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.buildUserToken(TokenServiceTests.java:941)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated(TokenServiceTests.java:437)
```
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java
}
    private static final Map<String, CheckedFunction<StreamInput, Object, IOException>> METADATA_VALUE_READER = Map.of(
        REMOTE_ACCESS_AUTHENTICATION_KEY,
        Authentication::new,
        REMOTE_ACCESS_ROLE_DESCRIPTORS_KEY,
        in -> in.readList(RoleDescriptorsBytes::new)
    );
    private static Map<String, Object> readMetadata(StreamInput in) throws IOException {
        if (in.getTransportVersion().onOrAfter(VERSION_METADATA_BEYOND_GENERIC_MAP)) {
            final int size = in.readVInt();
            final Map<String, Object> metadata = Maps.newHashMapWithExpectedSize(size);
            for (int i = 0; i < size; i++) {
                final String key = in.readString();
                final Object value = METADATA_VALUE_READER.getOrDefault(key, StreamInput::readGenericValue).apply(in);
                metadata.put(key, value);
            }
            return metadata;
        } else {
            return in.readMap();
        }
    }
    private static final Map<String, Writeable.Writer<?>> METADATA_VALUE_WRITER = Map.of(
        REMOTE_ACCESS_AUTHENTICATION_KEY,
        (out, v) -> ((Authentication) v).writeTo(out),
        REMOTE_ACCESS_ROLE_DESCRIPTORS_KEY,
        (out, v) -> {
            @SuppressWarnings("unchecked")
            final List<RoleDescriptorsBytes> roleDescriptorsBytesList = (List<RoleDescriptorsBytes>) v;
            out.writeCollection(roleDescriptorsBytesList, (o, rdb) -> rdb.writeTo(o));
        }