Consistent errors for KeyStoreWrapper decryption with any security provider

[jkakavas]

As identified in #57050 (comment) , when using the BouncyCastle FIPS security provider, the decryption with a wrong password fails in non predictable ways. Sometimes the CipherInputStream doesn't throw an AEADBadTagException as expected but readFully fails to read the stream fully and thus we fail because of these unconsumed stream contents:

elasticsearch/server/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java

Line 379 in c117c0c

throw new SecurityException("Keystore has been corrupted or tampered with");

We should look at a) why this happens and b) figure out if there is a way to consistently catch Exceptions caused by invalid passwords for any security provider so that we can throw a relevant and useful error message for the users.

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Settings)

[elasticmachine]

Pinging @elastic/es-security (:Security/Security)