Set metadata on request in API key noop test (#88507)

This PR fixes API key integration test setup for noops. In the noop
test, we use the initial update request as a reference to choose
suitable values to force non-noop updates, including metadata. However,
metadata can be null on the initial request, meaning that the
underlying API key will retain the metadata it was assigned on
creation. This can lead to test failure when the metadata on the
initial request is null, and the subsequent metadata update matches
the metadata chosen at API key creation time.

Closes #88503.

x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/xpack/security/authc/ApiKeyIntegTests.java

@@ -101,6 +101,7 @@
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutionException;
@@ -1744,7 +1745,9 @@ public void testNoopUpdateApiKey() throws ExecutionException, InterruptedExcepti
         final var initialRequest = new UpdateApiKeyRequest(
             apiKeyId,
             List.of(new RoleDescriptor(randomAlphaOfLength(10), new String[] { "all" }, null, null)),
-            ApiKeyTests.randomMetadata()
+            // Ensure not `null` to set metadata since we use the initialRequest further down in the test to ensure that
+            // metadata updates are non-noops
+            randomValueOtherThanMany(Objects::isNull, ApiKeyTests::randomMetadata)
         );
         UpdateApiKeyResponse response = executeUpdateApiKey(TEST_USER_NAME, initialRequest);
         assertNotNull(response);
@@ -1772,11 +1775,11 @@ public void testNoopUpdateApiKey() throws ExecutionException, InterruptedExcepti
         // Update with different role descriptors is not a noop
         final List<RoleDescriptor> newRoleDescriptors = List.of(
             randomValueOtherThanMany(
-                rd -> (RoleDescriptorRequestValidator.validate(rd) != null) && initialRequest.getRoleDescriptors().contains(rd) == false,
+                rd -> RoleDescriptorRequestValidator.validate(rd) != null || initialRequest.getRoleDescriptors().contains(rd),
                 () -> RoleDescriptorTests.randomRoleDescriptor(false)
             ),
             randomValueOtherThanMany(
-                rd -> (RoleDescriptorRequestValidator.validate(rd) != null) && initialRequest.getRoleDescriptors().contains(rd) == false,
+                rd -> RoleDescriptorRequestValidator.validate(rd) != null || initialRequest.getRoleDescriptors().contains(rd),
                 () -> RoleDescriptorTests.randomRoleDescriptor(false)
             )
         );