The logic for the cache in `JwtRealm` produces a broken `Cache` instance to some degree. 
We create a `BytesArray` from the user credential hash:

```java
            final BytesArray jwtCacheKey = isCacheEnabled() ? new BytesArray(jwtAuthenticationToken.getUserCredentialsHash()) : null;
            if (jwtCacheKey != null) {
                final User cachedUser = tryAuthenticateWithCache(tokenPrincipal, jwtCacheKey);
```

and use it as as a cache key in a `Cache` instance down the line.
But then we also clear the bytes in that `BytesArray` to `0` in org.elasticsearch.xpack.security.authc.jwt.JwtAuthenticationToken#clearCredentials. 

This leads to the hash map in the `Cache` getting filled with loads of `BytesArray` that all have the same 0-filled content but that were not equal to each other when first inserted into the map, causing the map to put them all in the same bucket.

<img width="1233" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/86a914d7-a2d4-4b01-ad99-e0d14e71a58b">

ref path to the broken map:

<img width="1436" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/87ac6f78-bc09-41c4-9a79-28fbbd14f6e6">

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/jwt/JwtRealmTestCase.java
import java.util.TreeSet;
import java.util.concurrent.ExecutionException;
import java.util.stream.IntStream;
import static org.hamcrest.Matchers.anEmptyMap;
import static org.hamcrest.Matchers.empty;
import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.hasEntry;
import static org.hamcrest.Matchers.hasKey;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.not;
import static org.hamcrest.Matchers.notNullValue;
import static org.hamcrest.Matchers.startsWith;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
public abstract class JwtRealmTestCase extends JwtTestCase {
    record JwtRealmSettingsBuilder(String name, Settings.Builder settingsBuilder) {}
    record JwtIssuerAndRealm(JwtIssuer issuer, JwtRealm realm, JwtRealmSettingsBuilder realmSettingsBuilder) {}
    protected ThreadPool threadPool;
    protected ResourceWatcherService resourceWatcherService;
    protected MockLicenseState licenseState;
    protected List<JwtIssuerAndRealm> jwtIssuerAndRealms;
    @Before
    public void init() throws Exception {
        threadPool = new TestThreadPool("JWT realm tests");
        resourceWatcherService = new ResourceWatcherService(Settings.EMPTY, threadPool);
        licenseState = mock(MockLicenseState.class);
        when(licenseState.isAllowed(Security.DELEGATED_AUTHORIZATION_FEATURE)).thenReturn(true);
    }
    @After
    public void shutdown() throws Exception {