### CI Link

https://gradle-enterprise.elastic.co/s/t2ljfz6qynjne

### Repro line

`gradlew ':x-pack:plugin:core:test' --tests "org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess" -Dtests.seed=4E9C8BABDD08D2FD -Dtests.locale=lv-LV -Dtests.timezone=Pacific/Nauru -Druntime.java=17`

### Does it reproduce?

Yes

### Applicable branches

main

### Failure history

_No response_

### Failure excerpt

```
REPRODUCE WITH: ./gradlew ':x-pack:plugin:core:test' --tests "org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess" -Dtests.seed=4E9C8BABDD08D2FD -Dtests.locale=lv-LV -Dtests.timezone=Pacific/Nauru -Druntime.java=17

org.elasticsearch.xpack.core.security.authc.AuthenticationTests > testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess FAILED
    java.lang.AssertionError: 
    Expected: <[7b 22 62 61 73 65 5f 72 6f 6c 65 22 3a 7b 22 63 6c 75 73 74 65 72 22 3a 5b 22 61 6c 6c 22 5d 7d 7d]>
         but: was <[7b 22 62 61 73 65 5f 72 6f 6c 65 22 3a 7b 22 63 6c 75 73 74 65 72 22 3a 5b 22 61 6c 6c 22 5d 2c a 22 72 65 6d 6f 74 65 5f 69 6e 64 69 63 65 73 22 3a 7b 22 6e 61 6d 65 73 22 3a 5b 22 6c 6f 67 73 2d 2a 22 5d 2c 22 70 72 69 76 69 6c 65 67 65 73 22 3a 5b 22 72 65 61 64 22 5d 2c 22 63 6c 75 73 74 65 72 73 22 3a 5b 22 6d 79 5f 63 6c 75 73 74 65 72 2a 22 2c 22 6f 74 68 65 72 5f 63 6c 75 73 74 65 72 22 5d 7d 7d a 7d]>
        at __randomizedtesting.SeedInfo.seed([4E9C8BABDD08D2FD:FFC7C3C66600B8E9]:0)
        at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:18)
        at org.junit.Assert.assertThat(Assert.java:956)
        at org.junit.Assert.assertThat(Assert.java:923)
        at org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess(AuthenticationTests.java:907)
```
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authc/AuthenticationTests.java
}
        assertThat(test.isAssignedToDomain(), is(false));
        assertThat(test.getDomain(), nullValue());
        test = Authentication.newRealmAuthentication(randomUser(), randomRealmRef(false));
        test = test.runAs(randomUser(), lookupRealmRef);
        if (randomBoolean()) {
            test = test.token();
        }
        assertThat(test.isAssignedToDomain(), is(true));
        assertThat(test.getDomain(), is(lookupRealmRef.getDomain()));
        
        test = randomApiKeyAuthentication(randomUser(), randomAlphaOfLengthBetween(10, 20), TransportVersion.CURRENT);
        assertThat(test.isAssignedToDomain(), is(false));
        assertThat(test.getDomain(), nullValue());
        if (randomBoolean()) {
            test = test.runAs(randomUser(), lookupRealmRef);
            if (randomBoolean()) {
                test = test.token();
            }
            assertThat(test.isAssignedToDomain(), is(true));
            assertThat(test.getDomain(), is(lookupRealmRef.getDomain()));
        } else {
            test = test.runAs(randomUser(), randomRealmRef(false));
            if (randomBoolean()) {
                test = test.token();
            }
            assertThat(test.isAssignedToDomain(), is(false));
            assertThat(test.getDomain(), nullValue());
        }