The logic for the cache in `JwtRealm` produces a broken `Cache` instance to some degree. 
We create a `BytesArray` from the user credential hash:

```java
            final BytesArray jwtCacheKey = isCacheEnabled() ? new BytesArray(jwtAuthenticationToken.getUserCredentialsHash()) : null;
            if (jwtCacheKey != null) {
                final User cachedUser = tryAuthenticateWithCache(tokenPrincipal, jwtCacheKey);
```

and use it as as a cache key in a `Cache` instance down the line.
But then we also clear the bytes in that `BytesArray` to `0` in org.elasticsearch.xpack.security.authc.jwt.JwtAuthenticationToken#clearCredentials. 

This leads to the hash map in the `Cache` getting filled with loads of `BytesArray` that all have the same 0-filled content but that were not equal to each other when first inserted into the map, causing the map to put them all in the same bucket.

<img width="1233" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/86a914d7-a2d4-4b01-ad99-e0d14e71a58b">

ref path to the broken map:

<img width="1436" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/87ac6f78-bc09-41c4-9a79-28fbbd14f6e6">

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/jwt/JwtRealmAuthenticateTests.java
final SecureString jwt = randomJwt(jwtIssuerAndRealm, user);
        final SignedJWT parsedJwt = SignedJWT.parse(jwt.toString());
        final JWTClaimsSet validClaimsSet = parsedJwt.getJWTClaimsSet();
        final int processors = Runtime.getRuntime().availableProcessors();
        final int numberOfThreads = Math.min(50, scaledRandomIntBetween((processors + 1) / 2, 4 * processors));  
        final Thread[] threads = new Thread[numberOfThreads];
        final CountDownLatch threadsCountDown = new CountDownLatch(numberOfThreads);
        final CountDownLatch racingCountDown = new CountDownLatch(1);
        final CountDownLatch completionCountDown = new CountDownLatch(numberOfThreads);
        for (int i = 0; i < numberOfThreads; i++) {
            if (randomBoolean()) {
                threads[i] = new Thread(() -> {
                    threadsCountDown.countDown();
                    try {
                        if (racingCountDown.await(10, TimeUnit.SECONDS)) {
                            jwtIssuerAndRealm.realm().expireAll();
                            completionCountDown.countDown();
                        } else {
                            throw new AssertionError("racing is not ready within the given time period");
                        }
                    } catch (InterruptedException e) {
                        throw new RuntimeException(e);
                    }
                });
            } else {
                threads[i] = new Thread(() -> {
                    final BytesArray jwtCacheKey = new BytesArray(randomAlphaOfLength(10));
                    final PlainActionFuture<AuthenticationResult<User>> future = new PlainActionFuture<>();
                    threadsCountDown.countDown();
                    try {