### CI Link

https://gradle-enterprise.elastic.co/s/bhuomrfypovuq

### Repro line

gradlew :x-pack:plugin:security:test --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17

### Does it reproduce?

Yes

### Applicable branches

main

### Failure history

_No response_

### Failure excerpt

```
  2> REPRODUCE WITH: ./gradlew ':x-pack:plugin:security:test' --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17
  2> java.lang.ClassCastException: class java.util.HashMap cannot be cast to class org.elasticsearch.common.bytes.BytesReference (java.util.HashMap is in module java.base of loader 'bootstrap'; org.elasticsearch.common.bytes.BytesReference is in unnamed module of loader 'app')
        at __randomizedtesting.SeedInfo.seed([819240371E8B1C23:50D848AB4705CC]:0)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadataForApiKeyRoleDescriptors(Authentication.java:1093)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadata(Authentication.java:271)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteForOlderVersion(Authentication.java:232)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.buildUserToken(TokenServiceTests.java:941)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated(TokenServiceTests.java:437)
```
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java
}
        static RealmRef newServiceAccountRealmRef(String nodeName) {
            
            return new Authentication.RealmRef(ServiceAccountSettings.REALM_NAME, ServiceAccountSettings.REALM_TYPE, nodeName, null);
        }
        static RealmRef newApiKeyRealmRef(String nodeName) {
            
            return new RealmRef(API_KEY_REALM_NAME, API_KEY_REALM_TYPE, nodeName, null);
        }
        static RealmRef newRemoteAccessRealmRef(String nodeName) {
            
            return new RealmRef(REMOTE_ACCESS_REALM_NAME, REMOTE_ACCESS_REALM_TYPE, nodeName, null);
        }
    }
    public static boolean isFileOrNativeRealm(String realmType) {
        return FileRealmSettings.TYPE.equals(realmType) || NativeRealmSettings.TYPE.equals(realmType);
    }
    public static ConstructingObjectParser<RealmRef, Void> REALM_REF_PARSER = new ConstructingObjectParser<>(
        "realm_ref",
        false,
        (args, v) -> new RealmRef((String) args[0], (String) args[1], (String) args[2], (RealmDomain) args[3])
    );
    static {
        REALM_REF_PARSER.declareString(constructorArg(), new ParseField("name"));
        REALM_REF_PARSER.declareString(constructorArg(), new ParseField("type"));
        REALM_REF_PARSER.declareString(constructorArg(), new ParseField("node_name"));
        REALM_REF_PARSER.declareObject(optionalConstructorArg(), (p, c) -> REALM_DOMAIN_PARSER.parse(p, c), new ParseField("domain"));
    }
    
    public static Authentication newInternalAuthentication(User internalUser, TransportVersion version, String nodeName) {