The logic for the cache in `JwtRealm` produces a broken `Cache` instance to some degree. 
We create a `BytesArray` from the user credential hash:

```java
            final BytesArray jwtCacheKey = isCacheEnabled() ? new BytesArray(jwtAuthenticationToken.getUserCredentialsHash()) : null;
            if (jwtCacheKey != null) {
                final User cachedUser = tryAuthenticateWithCache(tokenPrincipal, jwtCacheKey);
```

and use it as as a cache key in a `Cache` instance down the line.
But then we also clear the bytes in that `BytesArray` to `0` in org.elasticsearch.xpack.security.authc.jwt.JwtAuthenticationToken#clearCredentials. 

This leads to the hash map in the `Cache` getting filled with loads of `BytesArray` that all have the same 0-filled content but that were not equal to each other when first inserted into the map, causing the map to put them all in the same bucket.

<img width="1233" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/86a914d7-a2d4-4b01-ad99-e0d14e71a58b">

ref path to the broken map:

<img width="1436" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/87ac6f78-bc09-41c4-9a79-28fbbd14f6e6">

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/jwt/JwtRealmTestCase.java
JwtRealmInspector.getAllowedIssuer(jwtIssuerAndRealm.realm), 
            JwtRealmInspector.getAllowedAudiences(jwtIssuerAndRealm.realm), 
            randomBoolean() ? user.principal() : user.principal() + "_" + randomInt(9), 
            JwtRealmInspector.getPrincipalClaimName(jwtIssuerAndRealm.realm), 
            user.principal(), 
            JwtRealmInspector.getGroupsClaimName(jwtIssuerAndRealm.realm), 
            List.of(user.roles()), 
            Date.from(now.minusSeconds(60 * randomLongBetween(10, 20))), 
            Date.from(now.minusSeconds(randomBoolean() ? 0 : 60 * randomLongBetween(5, 10))), 
            Date.from(now), 
            Date.from(now.plusSeconds(60 * randomLongBetween(3600, 7200))), 
            randomBoolean() ? null : new Nonce(32).toString(),
            randomBoolean() ? null : Map.of("other1", randomAlphaOfLength(10), "other2", randomAlphaOfLength(10))
        );
        final SecureString signedJWT = signJwt(jwk, unsignedJwt);
        return signedJWT;
    }
    protected void printJwtRealmAndIssuer(JwtIssuerAndRealm jwtIssuerAndRealm) throws ParseException {
        printJwtIssuer(jwtIssuerAndRealm.issuer());
        printJwtRealm(jwtIssuerAndRealm.realm());
    }
    protected void printJwtRealm(final JwtRealm jwtRealm) {
        logger.info(
            "REALM["
                + jwtRealm.name()
                + ","
                + jwtRealm.order()
                + "/"
                + jwtIssuerAndRealms.size()
                + "]: clientType=["