[Test] Fix testGenerateMultipleCertificateWithNewCA

Fixes an edge case where we randomly generate an empty list of key
usages then pass it to `certutil` command.
The empty means just apply the defaults, but we assert based on the
generated empty set.

Resolves #126471

Author: slobodanadamovic

muted-tests.yml

@@ -411,9 +411,6 @@ tests:
 - class: org.elasticsearch.xpack.test.rest.XPackRestIT
   method: test {p0=transform/transforms_start_stop/Test start/stop only starts/stops specified transform}
   issue: https://github.com/elastic/elasticsearch/issues/126466
-- class: org.elasticsearch.xpack.security.cli.HttpCertificateCommandTests
-  method: testGenerateMultipleCertificateWithNewCA
-  issue: https://github.com/elastic/elasticsearch/issues/126471
 - class: org.elasticsearch.xpack.downsample.ILMDownsampleDisruptionIT
   method: testILMDownsampleRollingRestart
   issue: https://github.com/elastic/elasticsearch/issues/126495

x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java

@@ -380,7 +380,7 @@ public void testGenerateMultipleCertificateWithNewCA() throws Exception {
             caDN = "CN=" + randomAlphaOfLengthBetween(3, 8);
             caYears = randomIntBetween(1, 3);
             caKeySize = randomFrom(2048, 3072, 4096);
-            caKeyUsage = randomSubsetOf(CertGenUtils.KEY_USAGE_MAPPINGS.keySet());
+            caKeyUsage = randomNonEmptySubsetOf(CertGenUtils.KEY_USAGE_MAPPINGS.keySet());
             terminal.addTextInput(caDN);
             terminal.addTextInput(caYears + "y");
             terminal.addTextInput(Integer.toString(caKeySize));