The logic for the cache in `JwtRealm` produces a broken `Cache` instance to some degree. 
We create a `BytesArray` from the user credential hash:

```java
            final BytesArray jwtCacheKey = isCacheEnabled() ? new BytesArray(jwtAuthenticationToken.getUserCredentialsHash()) : null;
            if (jwtCacheKey != null) {
                final User cachedUser = tryAuthenticateWithCache(tokenPrincipal, jwtCacheKey);
```

and use it as as a cache key in a `Cache` instance down the line.
But then we also clear the bytes in that `BytesArray` to `0` in org.elasticsearch.xpack.security.authc.jwt.JwtAuthenticationToken#clearCredentials. 

This leads to the hash map in the `Cache` getting filled with loads of `BytesArray` that all have the same 0-filled content but that were not equal to each other when first inserted into the map, causing the map to put them all in the same bucket.

<img width="1233" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/86a914d7-a2d4-4b01-ad99-e0d14e71a58b">

ref path to the broken map:

<img width="1436" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/87ac6f78-bc09-41c4-9a79-28fbbd14f6e6">

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/jwt/JwtRealm.java
this.claimParserName = ClaimParser.forSetting(logger, JwtRealmSettings.CLAIMS_NAME, fallbackClaimNames, realmConfig, false);
    }
    /**
     * If X-pack licensing allows it, initialize delegated authorization support.
     * JWT realm will use the list of all realms to link to its named authorization realms.
     * @param allRealms List of all realms containing authorization realms for this JWT realm.
     * @param xpackLicenseState X-pack license state.
     */
    @Override
    public void initialize(final Iterable<Realm> allRealms, final XPackLicenseState xpackLicenseState) {
        if (delegatedAuthorizationSupport != null) {
            throw new IllegalStateException("Realm " + name() + " has already been initialized");
        }
        
        delegatedAuthorizationSupport = new DelegatedAuthorizationSupport(allRealms, config, xpackLicenseState);
        final List<Function<JWTClaimsSet, String>> tokenPrincipalFunctions = new ArrayList<>();
        for (var realm : allRealms) {
            if (realm instanceof final JwtRealm jwtRealm) {
                tokenPrincipalFunctions.add(jwtRealm::buildTokenPrincipal);
            }
        }
        this.tokenPrincipalFunctions = List.copyOf(tokenPrincipalFunctions);
    }
    /**
     * Clean up JWT cache (if enabled).
     * Clean up HTTPS client cache (if enabled).
     */
    @Override
    public void close() {
        jwtAuthenticator.close();