The logic for the cache in `JwtRealm` produces a broken `Cache` instance to some degree. 
We create a `BytesArray` from the user credential hash:

```java
            final BytesArray jwtCacheKey = isCacheEnabled() ? new BytesArray(jwtAuthenticationToken.getUserCredentialsHash()) : null;
            if (jwtCacheKey != null) {
                final User cachedUser = tryAuthenticateWithCache(tokenPrincipal, jwtCacheKey);
```

and use it as as a cache key in a `Cache` instance down the line.
But then we also clear the bytes in that `BytesArray` to `0` in org.elasticsearch.xpack.security.authc.jwt.JwtAuthenticationToken#clearCredentials. 

This leads to the hash map in the `Cache` getting filled with loads of `BytesArray` that all have the same 0-filled content but that were not equal to each other when first inserted into the map, causing the map to put them all in the same bucket.

<img width="1233" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/86a914d7-a2d4-4b01-ad99-e0d14e71a58b">

ref path to the broken map:

<img width="1436" alt="image" src="https://github.com/elastic/elasticsearch/assets/6490959/87ac6f78-bc09-41c4-9a79-28fbbd14f6e6">

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/jwt/JwtRealmAuthenticateTests.java
);
        final JwtIssuerAndRealm jwtIssuerAndRealm = randomJwtIssuerRealmPair();
        assertThat(jwtIssuerAndRealm.realm().delegatedAuthorizationSupport.hasDelegation(), is(false));
        final User user = randomUser(jwtIssuerAndRealm.issuer());
        final SecureString jwtJwks1 = randomJwt(jwtIssuerAndRealm, user);
        final SecureString clientSecret = JwtRealmInspector.getClientAuthenticationSharedSecret(jwtIssuerAndRealm.realm());
        final int jwtAuthcCount = randomIntBetween(2, 3);
        doMultipleAuthcAuthzAndVerifySuccess(jwtIssuerAndRealm.realm(), user, jwtJwks1, clientSecret, jwtAuthcCount);
        
        final String jwt1JwksAlg = SignedJWT.parse(jwtJwks1.toString()).getHeader().getAlgorithm().getName();
        final boolean isPkcJwtJwks1 = JwtRealmSettings.SUPPORTED_SIGNATURE_ALGORITHMS_PKC.contains(jwt1JwksAlg);
        logger.debug("JWT alg=[{}]", jwt1JwksAlg);
        
        final List<JwtIssuer.AlgJwkPair> jwtIssuerJwks1Backup = jwtIssuerAndRealm.issuer().algAndJwksAll;
        final boolean jwtIssuerJwks1OidcSafe = JwkValidateUtilTests.areJwkHmacOidcSafe(
            jwtIssuerJwks1Backup.stream().map(e -> e.jwk()).toList()
        );
        logger.debug("JWKs 1, algs=[{}]", String.join(",", jwtIssuerAndRealm.issuer().algorithmsAll));
        
        logger.debug("JWKs 1 backed up, algs=[{}]", String.join(",", jwtIssuerAndRealm.issuer().algorithmsAll));
        jwtIssuerAndRealm.issuer().setJwks(Collections.emptyList(), jwtIssuerJwks1OidcSafe);
        printJwtIssuer(jwtIssuerAndRealm.issuer());
        copyIssuerJwksToRealmConfig(jwtIssuerAndRealm);
        logger.debug("JWKs 1 emptied, algs=[{}]", String.join(",", jwtIssuerAndRealm.issuer().algorithmsAll));
        
        doMultipleAuthcAuthzAndVerifySuccess(jwtIssuerAndRealm.realm(), user, jwtJwks1, clientSecret, jwtAuthcCount);
        logger.debug("JWT 1 still worked, because JWT realm has old JWKs cached in memory");
        
        jwtIssuerAndRealm.issuer().setJwks(jwtIssuerJwks1Backup, jwtIssuerJwks1OidcSafe);
        printJwtIssuer(jwtIssuerAndRealm.issuer());