### CI Link

https://gradle-enterprise.elastic.co/s/t2ljfz6qynjne

### Repro line

`gradlew ':x-pack:plugin:core:test' --tests "org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess" -Dtests.seed=4E9C8BABDD08D2FD -Dtests.locale=lv-LV -Dtests.timezone=Pacific/Nauru -Druntime.java=17`

### Does it reproduce?

Yes

### Applicable branches

main

### Failure history

_No response_

### Failure excerpt

```
REPRODUCE WITH: ./gradlew ':x-pack:plugin:core:test' --tests "org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess" -Dtests.seed=4E9C8BABDD08D2FD -Dtests.locale=lv-LV -Dtests.timezone=Pacific/Nauru -Druntime.java=17

org.elasticsearch.xpack.core.security.authc.AuthenticationTests > testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess FAILED
    java.lang.AssertionError: 
    Expected: <[7b 22 62 61 73 65 5f 72 6f 6c 65 22 3a 7b 22 63 6c 75 73 74 65 72 22 3a 5b 22 61 6c 6c 22 5d 7d 7d]>
         but: was <[7b 22 62 61 73 65 5f 72 6f 6c 65 22 3a 7b 22 63 6c 75 73 74 65 72 22 3a 5b 22 61 6c 6c 22 5d 2c a 22 72 65 6d 6f 74 65 5f 69 6e 64 69 63 65 73 22 3a 7b 22 6e 61 6d 65 73 22 3a 5b 22 6c 6f 67 73 2d 2a 22 5d 2c 22 70 72 69 76 69 6c 65 67 65 73 22 3a 5b 22 72 65 61 64 22 5d 2c 22 63 6c 75 73 74 65 72 73 22 3a 5b 22 6d 79 5f 63 6c 75 73 74 65 72 2a 22 2c 22 6f 74 68 65 72 5f 63 6c 75 73 74 65 72 22 5d 7d 7d a 7d]>
        at __randomizedtesting.SeedInfo.seed([4E9C8BABDD08D2FD:FFC7C3C66600B8E9]:0)
        at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:18)
        at org.junit.Assert.assertThat(Assert.java:956)
        at org.junit.Assert.assertThat(Assert.java:923)
        at org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess(AuthenticationTests.java:907)
```
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authc/AuthenticationTests.java
&& runAsRealmRef.getDomain().realms().stream().anyMatch(r -> FileRealmSettings.TYPE.equals(r.getType())))
            || (otherRealmIdentifier.getType().equals(NativeRealmSettings.TYPE)
                && runAsRealmRef.getDomain().realms().stream().anyMatch(r -> NativeRealmSettings.TYPE.equals(r.getType())))) {
            assertThat(runAsAuthentication.canAccessResourcesOf(otherRealmAuthentication), is(true));
            assertThat(runAsAuthentication.canAccessResourcesOf(otherRealmAuthentication.token()), is(true));
        } else {
            assertThat(runAsAuthentication.canAccessResourcesOf(otherRealmAuthentication), is(false));
            assertThat(runAsAuthentication.canAccessResourcesOf(otherRealmAuthentication.token()), is(false));
        }
    }
    public void testDomainSerialize() throws Exception {
        Authentication test = randomRealmAuthentication(true);
        boolean runAs = randomBoolean();
        if (runAs) {
            test = test.runAs(randomUser(), randomRealmRef(true));
        }
        try (BytesStreamOutput out = new BytesStreamOutput()) {
            test.writeTo(out);
            StreamInput in = out.bytes().streamInput();
            Authentication testBack = new Authentication(in);
            assertThat(test.getDomain(), is(testBack.getDomain()));
        }
        try (BytesStreamOutput out = new BytesStreamOutput()) {
            out.setTransportVersion(TransportVersion.V_8_0_0);
            test.writeTo(out);
            StreamInput in = out.bytes().streamInput();
            in.setTransportVersion(TransportVersion.V_8_0_0);
            Authentication testBack = new Authentication(in);
            assertThat(testBack.getDomain(), nullValue());
            assertThat(testBack.isAssignedToDomain(), is(false));