Un-encrypt access tokens

[albertzaharovits]

Right now access tokens are encrypted (AES/GCM - authenticated encryption). Since 6.2, the access token is a random UUID, by which we pull the user token from the .security index (the format moved from a self-encoded token to an identifier). Hence, I don't think we require the confidentiality and integrity any longer.

Should we un-encrypt access tokens?

[elasticmachine]

Pinging @elastic/es-security

[jkakavas]

I have this also in my potential to-do list, but it needs to be discussed - I added it to the agenda for our next meeting

[jkakavas]

This was resolved as part of #39631