### Description

Currently, the [`tryAuthenticateToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L458) method calls `decodeAndValidateToken` which ends up sending two `GetRequest` for the same token ID. First in [`decodeToken`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L602) and second in [`checkIfTokenIsValid`](https://github.com/elastic/elasticsearch/blob/55088d154d1764a6d4fa8e9078bde9da1e9ff9a5/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java#L1977). The second call is unnecessary as we already fetched the access token in the first call, it's just simply dropped. We should refactor these two methods to avoid sending second get request just to validate the access token.
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
*/
    public void refreshToken(String refreshToken, ActionListener<CreateTokenResult> listener) {
        ensureEnabled();
        final Instant refreshRequested = clock.instant();
        final Iterator<TimeValue> backoff = DEFAULT_BACKOFF.iterator();
        final Consumer<Exception> onFailure = ex -> listener.onFailure(traceLog("find token by refresh token", refreshToken, ex));
        findTokenFromRefreshToken(refreshToken, backoff, ActionListener.wrap(tokenDoc -> {
            if (tokenDoc == null) {
                logger.warn("could not find token document for refresh token");
                onFailure.accept(invalidGrantException("could not refresh the requested token"));
            } else {
                final Authentication clientAuth = securityContext.getAuthentication();
                innerRefresh(refreshToken, tokenDoc, clientAuth, backoff, refreshRequested, listener);
            }
        }, e -> listener.onFailure(invalidGrantException("could not refresh the requested token"))));
    }
    /**
     * Infers the format and version of the passed in {@code refreshToken}. Delegates the actual search of the token document to
     * {@code #findTokenFromRefreshToken(String, SecurityIndexManager, Iterator, ActionListener)} .
     */
    private void findTokenFromRefreshToken(String refreshToken, Iterator<TimeValue> backoff, ActionListener<Doc> listener) {
        if (refreshToken.length() == TOKEN_LENGTH) {
            
            logger.debug(
                "Assuming an unversioned refresh token [{}], generated for node versions"
                    + " prior to the introduction of the version-header format.",
                refreshToken
            );
            findTokenFromRefreshToken(refreshToken, securityMainIndex, backoff, listener);
        } else {