The logic for the cache in `JwtRealm` produces a broken `Cache` instance to some degree. 
We create a `BytesArray` from the user credential hash:

```java
            final BytesArray jwtCacheKey = isCacheEnabled() ? new BytesArray(jwtAuthenticationToken.getUserCredentialsHash()) : null;
            if (jwtCacheKey != null) {
                final User cachedUser = tryAuthenticateWithCache(tokenPrincipal, jwtCacheKey);
```

and use it as as a cache key in a `Cache` instance down the line.
But then we also clear the bytes in that `BytesArray` to `0` in org.elasticsearch.xpack.security.authc.jwt.JwtAuthenticationToken#clearCredentials. 

This leads to the hash map in the `Cache` getting filled with loads of `BytesArray` that all have the same 0-filled content but that were not equal to each other when first inserted into the map, causing the map to put them all in the same bucket.

<img width="1233" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/86a914d7-a2d4-4b01-ad99-e0d14e71a58b">

ref path to the broken map:

<img width="1436" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/87ac6f78-bc09-41c4-9a79-28fbbd14f6e6">

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/jwt/JwtRealm.java
logger.debug(
                        "Realm [{}] JWT validation success for token=[{}] with header [{}] and claimSet [{}]",
                        name(),
                        tokenPrincipal,
                        jwtAuthenticationToken.getSignedJWT().getHeader(),
                        jwtAuthenticationToken.getJWTClaimsSet()
                    );
                }
                processValidatedJwt(tokenPrincipal, jwtCacheKey, claimsSet, listener);
            }, ex -> {
                final String msg = "Realm ["
                    + name()
                    + "] JWT validation failed for token=["
                    + tokenPrincipal
                    + "] with header ["
                    + jwtAuthenticationToken.getSignedJWT().getHeader()
                    + "] and claimSet ["
                    + jwtAuthenticationToken.getJWTClaimsSet()
                    + "]";
                if (logger.isTraceEnabled()) {
                    logger.trace(msg, ex);
                } else {
                    logger.debug(msg + " Cause: " + ex.getMessage()); 
                }
                
                listener.onResponse(AuthenticationResult.unsuccessful(msg, ex));
            }));
        } else {
            assert false : "should not happen";
            final String className = (authenticationToken == null) ? "null" : authenticationToken.getClass().getCanonicalName();