### Elasticsearch Version

Tested against 8.6.0

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

Ubuntu

### Problem Description

When `search.allow_expensive_queries` is set to `false` some queries may fail since they are considered expensive. Typically there is an obvious connection between the action you are performing and any errors raised due to expensive queries. For example, if you explicitly issue a [prefix query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-prefix-query.html) and  `search.allow_expensive_queries` is set to `false` there is a natural correlation between your request and the error. 

It has been found that when the following conditions are met 

* The API key or role has application level privileges
* One of the application level privileges has a trailing wildcard in the application name (i.e. `myapp*`) 
* The API key or role  is not cached 

then authentication will fail due to an error [1] related to the expensive query. This because internally the code issues a prefix query to for the application name. The end result is the API key can longer be used for authentication for any action. 

Workaround include : 
* set `search.allow_expensive_queries` is set to `true`
* remove the `*` from the application privilege name

It is also possible to set  `search.allow_expensive_queries` to  `true` make a call with the API key or user with the role so that it gets cached, then set `search.allow_expensive_queries` back to `false` . That will cause the API key or role to be cached, and it will work after that, but it can also start to fail again at what would seem a random time if ever evicted from the cache or the node gets restarted. For this reason, that work around is not suggested. 

[1] Example exception. Note - other similar exceptions can occur but they all reference `search.allow_expensive_queries` and the `.security-*` index 
```
Caused by: [.security-7/9mbNjDCNRzSzrDtj2YEeKQ] org.elasticsearch.index.query.QueryShardException: failed to create query: [prefix] queries cannot be executed when 'search.allow_expensive_queries' is set to false. For optimised prefix queries on text fields please enable [index_prefixes].
	at org.elasticsearch.index.query.SearchExecutionContext.toQuery(SearchExecutionContext.java:548)
	at org.elasticsearch.index.query.SearchExecutionContext.toQuery(SearchExecutionContext.java:531)
	at org.elasticsearch.search.SearchService.parseSource(SearchService.java:1174)
	at org.elasticsearch.search.SearchService.createContext(SearchService.java:986)
	at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:630)
	at org.elasticsearch.search.SearchService.lambda$executeQueryPhase$2(SearchService.java:495)
	at org.elasticsearch.action.ActionRunnable$2.accept(ActionRunnable.java:50)
	at org.elasticsearch.action.ActionRunnable$2.accept(ActionRunnable.java:47)
	at org.elasticsearch.action.ActionRunnable$3.doRun(ActionRunnable.java:72)
	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:917)
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.lang.Thread.run(Thread.java:1589)
```

### Steps to Reproduce

```
PUT _cluster/settings
{
    "persistent": {
        "search.allow_expensive_queries": "false"
    }
}

POST _security/api_key
{
  "name": "my_api_key",
  "role_descriptors": {
    "role1": {
      "cluster": ["all"],
      "indices": [
        {
          "names": ["test"],
          "privileges": ["write"]
        }
      ],
      "applications": [
        {
          "application": "app*",
          "privileges": ["read", "write"],
          "resources": ["*"]
        }
      ]
    }
  },
  "expiration": "1d"
}

using API key just created...

POST _bulk 
{ "index" : { "_index" : "test", "_id" : "4" } }
{ "field1" : "value1" }

```

EDIT: Updated text to suggest this can happen with an API key or a custom role
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java
public Map<String, Processor.Factory> getProcessors(Processor.Parameters parameters) {
        return Map.of(SetSecurityUserProcessor.TYPE, new SetSecurityUserProcessor.Factory(securityContext::get, settings));
    }
    @Override
    public void onNodeStarted() {
        this.nodeStartedListenable.onResponse(null);
    }
    /**
     * Realm settings were changed in 7.0. This method validates that the settings in use on this node match the new style of setting.
     * In 6.x a realm config would be
     * <pre>
     *   xpack.security.authc.realms.file1.type: file
     *   xpack.security.authc.realms.file1.order: 0
     * </pre>
     * In 7.x this realm should be
     * <pre>
     *   xpack.security.authc.realms.file.file1.order: 0
     * </pre>
     * If confronted with an old style config, the ES Settings validation would simply fail with an error such as
     * <em>unknown setting [xpack.security.authc.realms.file1.order]</em>. This validation method provides an error that is easier to
     * understand and take action on.
     */
    static void validateRealmSettings(Settings settings) {
        final Set<String> badRealmSettings = settings.keySet().stream().filter(k -> k.startsWith(RealmSettings.PREFIX)).filter(key -> {
            final String suffix = key.substring(RealmSettings.PREFIX.length());
            
            return suffix.indexOf('.') == suffix.lastIndexOf('.');
        }).collect(Collectors.toSet());
        if (badRealmSettings.isEmpty() == false) {
            String sampleRealmSetting = RealmSettings.realmSettingPrefix(new RealmConfig.RealmIdentifier("file", "my_file")) + "order";