(Failed on my PR but reproducible on main)
All tests from ServerCliTests fail when FIPS is enabled because it tries to create a keystore with empty password which is not allowed in FIPS approved-only mode.

I think this is introduced by #92378 where it changes how keystore is loaded. Previously, if the keystore does not exist, relevant code does not run. But it seems that the new [KeyStoreLoader](https://github.com/elastic/elasticsearch/blob/ae073712255f5ea18a3b50b2545d8f96bd89ba21/distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/KeyStoreLoader.java#L27C9-L32) still tries to execute the logic when keystore does not exist.

**Build scan:**
https://gradle-enterprise.elastic.co/s/2gfwy6dbzxjfo/tests/:distribution:tools:server-cli:test/org.elasticsearch.server.cli.ServerCliTests/testElasticsearchSettings

**Reproduction line:**
```
./gradlew ':distribution:tools:server-cli:test' --tests "org.elasticsearch.server.cli.ServerCliTests.testElasticsearchSettings" -Dtests.seed=20298E428D893458 -Dtests.locale=es-BO -Dtests.timezone=America/Bahia -Druntime.java=17 -Dtests.fips.enabled=true
```

**Applicable branches:**
main

**Reproduces locally?:**
Yes

**Failure history:**
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.server.cli.ServerCliTests&tests.test=testElasticsearchSettings

**Failure excerpt:**
```
java.security.GeneralSecurityException: Error generating an encryption key from the provided password

  at __randomizedtesting.SeedInfo.seed([20298E428D893458:B6DABAD7BBB16E04]:0)
  at org.elasticsearch.common.settings.KeyStoreWrapper.createCipher(KeyStoreWrapper.java:335)
  at org.elasticsearch.common.settings.KeyStoreWrapper.encrypt(KeyStoreWrapper.java:416)
  at org.elasticsearch.common.settings.KeyStoreWrapper.save(KeyStoreWrapper.java:459)
  at org.elasticsearch.common.settings.KeyStoreWrapper.save(KeyStoreWrapper.java:434)
  at org.elasticsearch.common.settings.KeyStoreWrapper.bootstrap(KeyStoreWrapper.java:239)
  at org.elasticsearch.server.cli.KeyStoreLoader.bootstrap(KeyStoreLoader.java:37)
  at org.elasticsearch.server.cli.ServerCli.execute(ServerCli.java:88)
  at org.elasticsearch.common.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:54)
  at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:85)
  at org.elasticsearch.cli.Command.main(Command.java:50)
  at org.elasticsearch.cli.CommandTestCase.executeMain(CommandTestCase.java:84)
  at org.elasticsearch.cli.CommandTestCase.assertOkWithOutput(CommandTestCase.java:111)
  at org.elasticsearch.cli.CommandTestCase.assertOk(CommandTestCase.java:107)
  at org.elasticsearch.server.cli.ServerCliTests.testElasticsearchSettings(ServerCliTests.java:172)
  at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(NativeMethodAccessorImpl.java:-2)
  at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
  at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:568)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.invoke(RandomizedRunner.java:1758)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$8.evaluate(RandomizedRunner.java:946)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$9.evaluate(RandomizedRunner.java:982)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$10.evaluate(RandomizedRunner.java:996)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at org.apache.lucene.tests.util.TestRuleSetupTeardownChained$1.evaluate(TestRuleSetupTeardownChained.java:48)
  at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
  at org.apache.lucene.tests.util.TestRuleThreadAndTestName$1.evaluate(TestRuleThreadAndTestName.java:45)
  at org.apache.lucene.tests.util.TestRuleIgnoreAfterMaxFailures$1.evaluate(TestRuleIgnoreAfterMaxFailures.java:60)
  at org.apache.lucene.tests.util.TestRuleMarkFailure$1.evaluate(TestRuleMarkFailure.java:44)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.forkTimeoutingTask(ThreadLeakControl.java:843)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$3.evaluate(ThreadLeakControl.java:490)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.runSingleTest(RandomizedRunner.java:955)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$5.evaluate(RandomizedRunner.java:840)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$6.evaluate(RandomizedRunner.java:891)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$7.evaluate(RandomizedRunner.java:902)
  at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at org.apache.lucene.tests.util.TestRuleStoreClassName$1.evaluate(TestRuleStoreClassName.java:38)
  at com.carrotsearch.randomizedtesting.rules.NoShadowingOrOverridesOnMethodsRule$1.evaluate(NoShadowingOrOverridesOnMethodsRule.java:40)
  at com.carrotsearch.randomizedtesting.rules.NoShadowingOrOverridesOnMethodsRule$1.evaluate(NoShadowingOrOverridesOnMethodsRule.java:40)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at org.apache.lucene.tests.util.TestRuleAssertionsRequired$1.evaluate(TestRuleAssertionsRequired.java:53)
  at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
  at org.apache.lucene.tests.util.TestRuleMarkFailure$1.evaluate(TestRuleMarkFailure.java:44)
  at org.apache.lucene.tests.util.TestRuleIgnoreAfterMaxFailures$1.evaluate(TestRuleIgnoreAfterMaxFailures.java:60)
  at org.apache.lucene.tests.util.TestRuleIgnoreTestSuites$1.evaluate(TestRuleIgnoreTestSuites.java:47)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.lambda$forkTimeoutingTask$0(ThreadLeakControl.java:850)
  at java.lang.Thread.run(Thread.java:833)

  Caused by: org.bouncycastle.crypto.fips.FipsUnapprovedOperationError: password must be at least 112 bits

    at org.bouncycastle.crypto.fips.FipsPBKD$Parameters.<init>(null:-1)
    at org.bouncycastle.crypto.fips.FipsPBKD$Parameters.<init>(null:-1)
    at org.bouncycastle.crypto.fips.FipsPBKD$ParametersBuilder.using(null:-1)
    at org.bouncycastle.jcajce.provider.ProvPBEPBKDF2$BasePBKDF2.engineGenerateSecret(null:-1)
    at javax.crypto.SecretKeyFactory.generateSecret(SecretKeyFactory.java:340)
    at org.elasticsearch.common.settings.KeyStoreWrapper.createCipher(KeyStoreWrapper.java:331)
    at org.elasticsearch.common.settings.KeyStoreWrapper.encrypt(KeyStoreWrapper.java:416)
    at org.elasticsearch.common.settings.KeyStoreWrapper.save(KeyStoreWrapper.java:459)
    at org.elasticsearch.common.settings.KeyStoreWrapper.save(KeyStoreWrapper.java:434)
    at org.elasticsearch.common.settings.KeyStoreWrapper.bootstrap(KeyStoreWrapper.java:239)
    at org.elasticsearch.server.cli.KeyStoreLoader.bootstrap(KeyStoreLoader.java:37)
    at org.elasticsearch.server.cli.ServerCli.execute(ServerCli.java:88)
    at org.elasticsearch.common.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:54)
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:85)
    at org.elasticsearch.cli.Command.main(Command.java:50)
    at org.elasticsearch.cli.CommandTestCase.executeMain(CommandTestCase.java:84)
    at org.elasticsearch.cli.CommandTestCase.assertOkWithOutput(CommandTestCase.java:111)
    at org.elasticsearch.cli.CommandTestCase.assertOk(CommandTestCase.java:107)
    at org.elasticsearch.server.cli.ServerCliTests.testElasticsearchSettings(ServerCliTests.java:172)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(NativeMethodAccessorImpl.java:-2)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:568)
    at com.carrotsearch.randomizedtesting.RandomizedRunner.invoke(RandomizedRunner.java:1758)
    at com.carrotsearch.randomizedtesting.RandomizedRunner$8.evaluate(RandomizedRunner.java:946)
    at com.carrotsearch.randomizedtesting.RandomizedRunner$9.evaluate(RandomizedRunner.java:982)
    at com.carrotsearch.randomizedtesting.RandomizedRunner$10.evaluate(RandomizedRunner.java:996)
    at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
    at org.apache.lucene.tests.util.TestRuleSetupTeardownChained$1.evaluate(TestRuleSetupTeardownChained.java:48)
    at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
    at org.apache.lucene.tests.util.TestRuleThreadAndTestName$1.evaluate(TestRuleThreadAndTestName.java:45)
    at org.apache.lucene.tests.util.TestRuleIgnoreAfterMaxFailures$1.evaluate(TestRuleIgnoreAfterMaxFailures.java:60)
    at org.apache.lucene.tests.util.TestRuleMarkFailure$1.evaluate(TestRuleMarkFailure.java:44)
    at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
    at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
    at com.carrotsearch.randomizedtesting.ThreadLeakControl.forkTimeoutingTask(ThreadLeakControl.java:843)
    at com.carrotsearch.randomizedtesting.ThreadLeakControl$3.evaluate(ThreadLeakControl.java:490)
    at com.carrotsearch.randomizedtesting.RandomizedRunner.runSingleTest(RandomizedRunner.java:955)
    at com.carrotsearch.randomizedtesting.RandomizedRunner$5.evaluate(RandomizedRunner.java:840)
    at com.carrotsearch.randomizedtesting.RandomizedRunner$6.evaluate(RandomizedRunner.java:891)
    at com.carrotsearch.randomizedtesting.RandomizedRunner$7.evaluate(RandomizedRunner.java:902)
    at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
    at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
    at org.apache.lucene.tests.util.TestRuleStoreClassName$1.evaluate(TestRuleStoreClassName.java:38)
    at com.carrotsearch.randomizedtesting.rules.NoShadowingOrOverridesOnMethodsRule$1.evaluate(NoShadowingOrOverridesOnMethodsRule.java:40)
    at com.carrotsearch.randomizedtesting.rules.NoShadowingOrOverridesOnMethodsRule$1.evaluate(NoShadowingOrOverridesOnMethodsRule.java:40)
    at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
    at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
    at org.apache.lucene.tests.util.TestRuleAssertionsRequired$1.evaluate(TestRuleAssertionsRequired.java:53)
    at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
    at org.apache.lucene.tests.util.TestRuleMarkFailure$1.evaluate(TestRuleMarkFailure.java:44)
    at org.apache.lucene.tests.util.TestRuleIgnoreAfterMaxFailures$1.evaluate(TestRuleIgnoreAfterMaxFailures.java:60)
    at org.apache.lucene.tests.util.TestRuleIgnoreTestSuites$1.evaluate(TestRuleIgnoreTestSuites.java:47)
    at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
    at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
    at com.carrotsearch.randomizedtesting.ThreadLeakControl.lambda$forkTimeoutingTask$0(ThreadLeakControl.java:850)
    at java.lang.Thread.run(Thread.java:833)

```
distribution/tools/server-cli/src/test/java/org/elasticsearch/server/cli/ServerCliTests.java
void syncPlugins(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws UserException;
    }
    SyncPluginsMethod syncPluginsCallback;
    private final MockSyncPluginsCli SYNC_PLUGINS_CLI = new MockSyncPluginsCli();
    @Before
    public void resetCommand() {
        argsValidator = null;
        autoConfigCallback = null;
        syncPluginsCallback = null;
        mockServerExitCode = 0;
    }
    private class MockAutoConfigCli extends EnvironmentAwareCommand {
        private final OptionSpec<String> enrollmentTokenOption;
        MockAutoConfigCli() {
            super("mock auto config tool");
            enrollmentTokenOption = parser.accepts("enrollment-token").withRequiredArg();
        }
        @Override
        protected void execute(Terminal terminal, OptionSet options, ProcessInfo processInfo) throws Exception {
            fail("Called wrong execute method, must call the one that takes already parsed env");
        }
        @Override
        public void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {
            
            if (autoConfigCallback != null) {
                autoConfigCallback.autoconfig(terminal, options, env, processInfo);
            }
        }
    }
    private class MockSyncPluginsCli extends EnvironmentAwareCommand {