The logic for the cache in `JwtRealm` produces a broken `Cache` instance to some degree. 
We create a `BytesArray` from the user credential hash:

```java
            final BytesArray jwtCacheKey = isCacheEnabled() ? new BytesArray(jwtAuthenticationToken.getUserCredentialsHash()) : null;
            if (jwtCacheKey != null) {
                final User cachedUser = tryAuthenticateWithCache(tokenPrincipal, jwtCacheKey);
```

and use it as as a cache key in a `Cache` instance down the line.
But then we also clear the bytes in that `BytesArray` to `0` in org.elasticsearch.xpack.security.authc.jwt.JwtAuthenticationToken#clearCredentials. 

This leads to the hash map in the `Cache` getting filled with loads of `BytesArray` that all have the same 0-filled content but that were not equal to each other when first inserted into the map, causing the map to put them all in the same bucket.

<img width="1233" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/86a914d7-a2d4-4b01-ad99-e0d14e71a58b">

ref path to the broken map:

<img width="1436" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/87ac6f78-bc09-41c4-9a79-28fbbd14f6e6">

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/jwt/JwtRealmTestCase.java
break realmLoop;
                    case CONTINUE:
                        assertThat("Expected realm CONTINUE status", candidateJwtRealm.name(), not(equalTo(jwtRealm.name())));
                        continue;
                    case TERMINATE:
                        fail("A JWT realm should never terminate the authentication process, but [" + candidateJwtRealm.name() + "] did");
                        break;
                    default:
                        fail("Unexpected AuthenticationResult.Status=[" + authenticationResult.getStatus() + "]");
                }
            }
            
            assertThat("Expected realm " + jwtRealm.name() + " to authenticate.", authenticatedUser, notNullValue());
            assertThat(user.principal(), equalTo(authenticatedUser.principal()));
            assertThat(new TreeSet<>(Arrays.asList(user.roles())), equalTo(new TreeSet<>(Arrays.asList(authenticatedUser.roles()))));
            if (jwtRealm.delegatedAuthorizationSupport.hasDelegation()) {
                assertThat(user.metadata(), equalTo(authenticatedUser.metadata())); 
            } else if (JwtRealmInspector.shouldPopulateUserMetadata(jwtRealm)) {
                assertThat(authenticatedUser.metadata(), hasEntry("jwt_token_type", JwtRealmInspector.getTokenType(jwtRealm).value()));
                assertThat(authenticatedUser.metadata(), hasKey(startsWith("jwt_claim_")));
            } else {
                assertThat(
                    authenticatedUser.metadata(),
                    equalTo(Map.of("jwt_token_type", JwtRealmInspector.getTokenType(jwtRealm).value()))
                );
            }
        }
        logger.info("Test succeeded");
    }
    protected User randomUser(final JwtIssuer jwtIssuer) {