### Description

Currently, the [`tryAuthenticateToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L458) method calls `decodeAndValidateToken` which ends up sending two `GetRequest` for the same token ID. First in [`decodeToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L602) and second in [`checkIfTokenIsValid`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L1977). The second call is unnecessary as we already fetched the access token in the first call, it's just simply dropped. We should refactor these two methods to avoid sending second get request just to validate the access token.
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
* Refresh tokens are bound to be used only by the client that originally created them. This check validates this condition, given the
     * {@code Authentication} of the client that attempted the refresh operation.
     */
    private static Optional<ElasticsearchSecurityException> checkClientCanRefresh(
        RefreshTokenStatus refreshToken,
        Authentication clientAuthentication
    ) {
        if (refreshToken.getAssociatedAuthentication() != null) {
            
            if (clientAuthentication.canAccessResourcesOf(refreshToken.getAssociatedAuthentication())) {
                return Optional.empty();
            } else {
                logger.warn(
                    "Token was originally created by [{}] but [{}] attempted to refresh it",
                    refreshToken.getAssociatedAuthentication(),
                    clientAuthentication
                );
                return Optional.of(invalidGrantException("tokens must be refreshed by the creating client"));
            }
        } else {
            
            if (clientAuthentication.getEffectiveSubject().getUser().principal().equals(refreshToken.getAssociatedUser()) == false) {
                logger.warn(
                    "Token was originally created by [{}] but [{}] attempted to refresh it",
                    refreshToken.getAssociatedUser(),
                    clientAuthentication.getEffectiveSubject().getUser().principal()
                );
                return Optional.of(invalidGrantException("tokens must be refreshed by the creating client"));
            } else if (clientAuthentication.getAuthenticatingSubject()
                .getRealm()