### CI Link

https://gradle-enterprise.elastic.co/s/bhuomrfypovuq

### Repro line

gradlew :x-pack:plugin:security:test --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17

### Does it reproduce?

Yes

### Applicable branches

main

### Failure history

_No response_

### Failure excerpt

```
  2> REPRODUCE WITH: ./gradlew ':x-pack:plugin:security:test' --tests "org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated" -Dtests.seed=819240371E8B1C23 -Dtests.locale=ms-MY -Dtests.timezone=Australia/Lindeman -Druntime.java=17
  2> java.lang.ClassCastException: class java.util.HashMap cannot be cast to class org.elasticsearch.common.bytes.BytesReference (java.util.HashMap is in module java.base of loader 'bootstrap'; org.elasticsearch.common.bytes.BytesReference is in unnamed module of loader 'app')
        at __randomizedtesting.SeedInfo.seed([819240371E8B1C23:50D848AB4705CC]:0)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadataForApiKeyRoleDescriptors(Authentication.java:1093)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteMetadata(Authentication.java:271)
        at org.elasticsearch.xpack.core.security.authc.Authentication.maybeRewriteForOlderVersion(Authentication.java:232)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.buildUserToken(TokenServiceTests.java:941)
        at org.elasticsearch.xpack.security.authc.TokenServiceTests.testInvalidateRefreshTokenThatIsAlreadyInvalidated(TokenServiceTests.java:437)
```
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java
return XContentHelper.convertToMap(roleDescriptorsBytes, false, XContentType.JSON).v2();
    }
    private static BytesReference convertRoleDescriptorsMapToBytes(Map<String, Object> roleDescriptorsMap) {
        try (XContentBuilder builder = XContentBuilder.builder(XContentType.JSON.xContent())) {
            builder.map(roleDescriptorsMap);
            return BytesReference.bytes(builder);
        } catch (IOException e) {
            throw new UncheckedIOException(e);
        }
    }
    static BytesReference maybeRemoveRemoteIndicesFromRoleDescriptors(BytesReference roleDescriptorsBytes) {
        if (roleDescriptorsBytes == null || roleDescriptorsBytes.length() == 0) {
            return roleDescriptorsBytes;
        }
        final Map<String, Object> roleDescriptorsMap = convertRoleDescriptorsBytesToMap(roleDescriptorsBytes);
        final AtomicBoolean removedAtLeastOne = new AtomicBoolean(false);
        roleDescriptorsMap.entrySet().stream().forEach(entry -> {
            if (entry.getValue() instanceof Map) {
                @SuppressWarnings("unchecked")
                Map<String, Object> roleDescriptor = (Map<String, Object>) entry.getValue();
                boolean removed = roleDescriptor.remove(RoleDescriptor.Fields.REMOTE_INDICES.getPreferredName()) != null;
                if (removed) {
                    removedAtLeastOne.set(true);
                }
            }
        });
        if (removedAtLeastOne.get()) {
            return convertRoleDescriptorsMapToBytes(roleDescriptorsMap);
        } else {