### Description

Currently, the [`tryAuthenticateToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L458) method calls `decodeAndValidateToken` which ends up sending two `GetRequest` for the same token ID. First in [`decodeToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L602) and second in [`checkIfTokenIsValid`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L1977). The second call is unnecessary as we already fetched the access token in the first call, it's just simply dropped. We should refactor these two methods to avoid sending second get request just to validate the access token.
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
client.threadPool()
                                    .schedule(
                                        () -> innerRefresh(refreshToken, tokenDoc, clientAuth, backoff, refreshRequested, listener),
                                        backoff.next(),
                                        GENERIC
                                    );
                            } else {
                                logger.warn("failed to update the original token document [{}], after all retries", tokenDoc.id());
                                onFailure.accept(invalidGrantException("could not refresh the requested token"));
                            }
                        } else {
                            onFailure.accept(e);
                        }
                    }),
                    client::update
                )
            );
        }
    }
    /**
     * Decrypts the values of the superseding access token and the refresh token, using a key derived from the superseded refresh token.
     * It verifies that the token document for the access token it decrypted exists first, before calling the listener.  It
     * encodes the version and serializes the tokens before calling the listener, in the same manner as {@link #createOAuth2Tokens } does.
     *
     * @param refreshToken       The refresh token that the user sent in the request, used to derive the decryption key
     * @param refreshTokenStatus The {@link RefreshTokenStatus} containing information about the superseding tokens as retrieved from the
     *                           index
     * @param tokensIndex        the manager for the index where the tokens are stored
     * @param authentication     The authentication object representing the user for which the tokens are created
     * @param listener The listener to call upon completion with a {@link CreateTokenResult} containing the