Multiple failures with same reasoning:

```
REPRODUCE WITH: ./gradlew ':x-pack:plugin:security:internalClusterTest' --tests "org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testTokenInvalidate" -Dtests.seed=B2E0E7CDA245B771 -Dtests.locale=is-IS -Dtests.timezone=US/Alaska -Druntime.java=20	
org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests > testTokenInvalidate FAILED	
    org.elasticsearch.client.ResponseException: method [POST], host [http://127.0.0.1:25065], URI [/_security/delegate_pki], status line [HTTP/1.1 401 Unauthorized]	
    {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}	
        at __randomizedtesting.SeedInfo.seed([B2E0E7CDA245B771:A7188691CD560670]:0)	
        at app//org.elasticsearch.client.RestClient.convertResponse(RestClient.java:347)	
        at app//org.elasticsearch.client.RestClient.performRequest(RestClient.java:313)	
        at app//org.elasticsearch.client.RestClient.performRequest(RestClient.java:288)	
        at app//org.elasticsearch.test.TestSecurityClient.execute(TestSecurityClient.java:490)	
        at app//org.elasticsearch.test.TestSecurityClient.delegatePkiAuthentication(TestSecurityClient.java:438)	
        at app//org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testTokenInvalidate(PkiAuthDelegationIntegTests.java:212)	
REPRODUCE WITH: ./gradlew ':x-pack:plugin:security:internalClusterTest' --tests "org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testDelegatePkiWithRoleMapping" -Dtests.seed=B2E0E7CDA245B771 -Dtests.locale=is-IS -Dtests.timezone=US/Alaska -Druntime.java=20	
org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests > testDelegatePkiWithRoleMapping FAILED	
    org.elasticsearch.client.ResponseException: method [POST], host [http://127.0.0.1:25066], URI [/_security/delegate_pki], status line [HTTP/1.1 401 Unauthorized]	
    {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}	
        at __randomizedtesting.SeedInfo.seed([B2E0E7CDA245B771:9BC2E6FF187AE036]:0)	
        at app//org.elasticsearch.client.RestClient.convertResponse(RestClient.java:347)	
        at app//org.elasticsearch.client.RestClient.performRequest(RestClient.java:313)	
        at app//org.elasticsearch.client.RestClient.performRequest(RestClient.java:288)	
        at app//org.elasticsearch.test.TestSecurityClient.execute(TestSecurityClient.java:490)	
        at app//org.elasticsearch.test.TestSecurityClient.delegatePkiAuthentication(TestSecurityClient.java:438)	
        at app//org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testDelegatePkiWithRoleMapping(PkiAuthDelegationIntegTests.java:342)	
REPRODUCE WITH: ./gradlew ':x-pack:plugin:security:internalClusterTest' --tests "org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testDelegateThenAuthenticate" -Dtests.seed=B2E0E7CDA245B771 -Dtests.locale=is-IS -Dtests.timezone=US/Alaska -Druntime.java=20	
org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests > testDelegateThenAuthenticate FAILED	
    org.elasticsearch.client.ResponseException: method [POST], host [http://127.0.0.1:25064], URI [/_security/delegate_pki], status line [HTTP/1.1 401 Unauthorized]	
    {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}	
        at __randomizedtesting.SeedInfo.seed([B2E0E7CDA245B771:74FA581F06F17BBA]:0)	
        at app//org.elasticsearch.client.RestClient.convertResponse(RestClient.java:347)	
        at app//org.elasticsearch.client.RestClient.performRequest(RestClient.java:313)	
        at app//org.elasticsearch.client.RestClient.performRequest(RestClient.java:288)	
        at app//org.elasticsearch.test.TestSecurityClient.execute(TestSecurityClient.java:490)	
        at app//org.elasticsearch.test.TestSecurityClient.delegatePkiAuthentication(TestSecurityClient.java:438)	
        at app//org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testDelegateThenAuthenticate(PkiAuthDelegationIntegTests.java:171)
```

**Build scan:**
https://gradle-enterprise.elastic.co/s/cpwmdyvwj2mf6/tests/:x-pack:plugin:security:internalClusterTest/org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests/testDelegatePkiWithRoleMapping

**Reproduction line:**
```
./gradlew ':x-pack:plugin:security:internalClusterTest' --tests "org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testDelegatePkiWithRoleMapping" -Dtests.seed=B2E0E7CDA245B771 -Dtests.locale=is-IS -Dtests.timezone=US/Alaska -Druntime.java=20
```

**Applicable branches:**
main, 8.9

**Reproduces locally?:**
Didn't try

**Failure history:**
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests&tests.test=testDelegatePkiWithRoleMapping

**Failure excerpt:**
```
org.elasticsearch.client.ResponseException: method [POST], host [http://127.0.0.1:25066], URI [/_security/delegate_pki], status line [HTTP/1.1 401 Unauthorized]
{"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [O=org, OU=Elasticsearch, CN=Elasticsearch Test Client] for action [cluster:admin/xpack/security/delegate_pki]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}

  at __randomizedtesting.SeedInfo.seed([B2E0E7CDA245B771:9BC2E6FF187AE036]:0)
  at org.elasticsearch.client.RestClient.convertResponse(RestClient.java:347)
  at org.elasticsearch.client.RestClient.performRequest(RestClient.java:313)
  at org.elasticsearch.client.RestClient.performRequest(RestClient.java:288)
  at org.elasticsearch.test.TestSecurityClient.execute(TestSecurityClient.java:490)
  at org.elasticsearch.test.TestSecurityClient.delegatePkiAuthentication(TestSecurityClient.java:438)
  at org.elasticsearch.xpack.security.authc.pki.PkiAuthDelegationIntegTests.testDelegatePkiWithRoleMapping(PkiAuthDelegationIntegTests.java:342)
  at jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
  at java.lang.reflect.Method.invoke(Method.java:578)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.invoke(RandomizedRunner.java:1758)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$8.evaluate(RandomizedRunner.java:946)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$9.evaluate(RandomizedRunner.java:982)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$10.evaluate(RandomizedRunner.java:996)
  at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at org.apache.lucene.tests.util.TestRuleSetupTeardownChained$1.evaluate(TestRuleSetupTeardownChained.java:48)
  at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
  at org.apache.lucene.tests.util.TestRuleThreadAndTestName$1.evaluate(TestRuleThreadAndTestName.java:45)
  at org.apache.lucene.tests.util.TestRuleIgnoreAfterMaxFailures$1.evaluate(TestRuleIgnoreAfterMaxFailures.java:60)
  at org.apache.lucene.tests.util.TestRuleMarkFailure$1.evaluate(TestRuleMarkFailure.java:44)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.forkTimeoutingTask(ThreadLeakControl.java:843)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$3.evaluate(ThreadLeakControl.java:490)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.runSingleTest(RandomizedRunner.java:955)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$5.evaluate(RandomizedRunner.java:840)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$6.evaluate(RandomizedRunner.java:891)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$7.evaluate(RandomizedRunner.java:902)
  at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at org.apache.lucene.tests.util.TestRuleStoreClassName$1.evaluate(TestRuleStoreClassName.java:38)
  at com.carrotsearch.randomizedtesting.rules.NoShadowingOrOverridesOnMethodsRule$1.evaluate(NoShadowingOrOverridesOnMethodsRule.java:40)
  at com.carrotsearch.randomizedtesting.rules.NoShadowingOrOverridesOnMethodsRule$1.evaluate(NoShadowingOrOverridesOnMethodsRule.java:40)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at org.apache.lucene.tests.util.TestRuleAssertionsRequired$1.evaluate(TestRuleAssertionsRequired.java:53)
  at org.apache.lucene.tests.util.AbstractBeforeAfterRule$1.evaluate(AbstractBeforeAfterRule.java:43)
  at org.apache.lucene.tests.util.TestRuleMarkFailure$1.evaluate(TestRuleMarkFailure.java:44)
  at org.apache.lucene.tests.util.TestRuleIgnoreAfterMaxFailures$1.evaluate(TestRuleIgnoreAfterMaxFailures.java:60)
  at org.apache.lucene.tests.util.TestRuleIgnoreTestSuites$1.evaluate(TestRuleIgnoreTestSuites.java:47)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.lambda$forkTimeoutingTask$0(ThreadLeakControl.java:850)
  at java.lang.Thread.run(Thread.java:1623)

```
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/xpack/security/authc/pki/PkiAuthDelegationIntegTests.java
} else {
            certificateChain = List.of(clientCertificate, intermediateCA, rootCA);
        }
        final RequestOptions testUserOptions = RequestOptions.DEFAULT.toBuilder()
            .addHeader(
                "Authorization",
                basicAuthHeaderValue(
                    SecuritySettingsSource.TEST_USER_NAME,
                    new SecureString(SecuritySettingsSourceField.TEST_PASSWORD.toCharArray())
                )
            )
            .build();
        final TestSecurityClient securityClient = getSecurityClient(testUserOptions);
        
        String roleMapping = """
            {
                "enabled": true,
                "roles": [ "role_by_delegated_user" ],
                "rules": {
                  "field": { "metadata.pki_delegated_by_user": "test_user" }
                }
            }
            """;
        securityClient.putRoleMapping("role_by_delegated_user", roleMapping);
        roleMapping = """
            {
                "enabled": true,
                "roles": [ "role_by_delegated_realm" ],
                "rules": {
                  "field": { "metadata.pki_delegated_by_realm": "file" }