### CI Link

https://gradle-enterprise.elastic.co/s/t2ljfz6qynjne

### Repro line

`gradlew ':x-pack:plugin:core:test' --tests "org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess" -Dtests.seed=4E9C8BABDD08D2FD -Dtests.locale=lv-LV -Dtests.timezone=Pacific/Nauru -Druntime.java=17`

### Does it reproduce?

Yes

### Applicable branches

main

### Failure history

_No response_

### Failure excerpt

```
REPRODUCE WITH: ./gradlew ':x-pack:plugin:core:test' --tests "org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess" -Dtests.seed=4E9C8BABDD08D2FD -Dtests.locale=lv-LV -Dtests.timezone=Pacific/Nauru -Druntime.java=17

org.elasticsearch.xpack.core.security.authc.AuthenticationTests > testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess FAILED
    java.lang.AssertionError: 
    Expected: <[7b 22 62 61 73 65 5f 72 6f 6c 65 22 3a 7b 22 63 6c 75 73 74 65 72 22 3a 5b 22 61 6c 6c 22 5d 7d 7d]>
         but: was <[7b 22 62 61 73 65 5f 72 6f 6c 65 22 3a 7b 22 63 6c 75 73 74 65 72 22 3a 5b 22 61 6c 6c 22 5d 2c a 22 72 65 6d 6f 74 65 5f 69 6e 64 69 63 65 73 22 3a 7b 22 6e 61 6d 65 73 22 3a 5b 22 6c 6f 67 73 2d 2a 22 5d 2c 22 70 72 69 76 69 6c 65 67 65 73 22 3a 5b 22 72 65 61 64 22 5d 2c 22 63 6c 75 73 74 65 72 73 22 3a 5b 22 6d 79 5f 63 6c 75 73 74 65 72 2a 22 2c 22 6f 74 68 65 72 5f 63 6c 75 73 74 65 72 22 5d 7d 7d a 7d]>
        at __randomizedtesting.SeedInfo.seed([4E9C8BABDD08D2FD:FFC7C3C66600B8E9]:0)
        at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:18)
        at org.junit.Assert.assertThat(Assert.java:956)
        at org.junit.Assert.assertThat(Assert.java:923)
        at org.elasticsearch.xpack.core.security.authc.AuthenticationTests.testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteAccess(AuthenticationTests.java:907)
```
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authc/AuthenticationTests.java
assertCanAccessResources(original2, token2.token());
        assertCanAccessResources(token2, token2.token());
        assertCannotAccessResources(original, original2);
        assertCannotAccessResources(original, token2);
        assertCannotAccessResources(token, original2);
        assertCannotAccessResources(token, token2);
        assertCannotAccessResources(token.token(), token2);
        assertCannotAccessResources(token, token2.token());
        Authentication original3 = Authentication.newAnonymousAuthentication(
            new AnonymousUser(Settings.EMPTY),
            randomAlphaOfLengthBetween(3, 8)
        );
        Authentication token3 = original3.token();
        assertCanAccessResources(original3, token3);
        assertCanAccessResources(original3, token3.token());
        assertCanAccessResources(token3, token3.token());
    }
    public void testRunAsAccessResourceOf() {
        final User user = randomUser();
        final User otherUser = randomValueOtherThan(user, () -> randomUser());
        final RealmRef realmRef = randomRealmRef(false);
        final RealmRef otherRealmRef = randomValueOtherThan(realmRef, () -> randomRealmRef(false));
        Authentication original = Authentication.newRealmAuthentication(user, realmRef);
        
        Authentication runAs1 = Authentication.newRealmAuthentication(otherUser, otherRealmRef).runAs(user, realmRef);
        assertCanAccessResources(original, runAs1);
        assertCanAccessResources(original.token(), runAs1);
        assertCanAccessResources(original, runAs1.token());
        assertCanAccessResources(original.token(), runAs1.token());
        Authentication runAs2 = randomApiKeyAuthentication(otherUser, randomAlphaOfLength(8)).runAs(user, realmRef);