[Test] Fix testGenerateMultipleCertificateWithNewCA (elastic#126621)

Fixes an edge case where we randomly generate an empty list of key
usages then pass it to `certutil` command.
The empty means just apply the defaults, but we assert based on the
generated empty set.

Resolves elastic#126471

Co-authored-by: Tim Vernum <[email protected]>
(cherry picked from commit 3db258e)

# Conflicts:
#	muted-tests.yml

Author: slobodanadamovic

muted-tests.yml

@@ -256,9 +256,6 @@ tests:
 - class: org.elasticsearch.xpack.esql.expression.function.scalar.convert.ParseIpTests
   method: testLeadingZerosAreOctal {TestCase[str=v4, validLeadingZerosRejected=true, validLeadingZerosAreDecimal=true, validLeadingZerosAreOctal=true]}
   issue: https://github.com/elastic/elasticsearch/issues/126496
-- class: org.elasticsearch.xpack.security.cli.HttpCertificateCommandTests
-  method: testGenerateMultipleCertificateWithNewCA
-  issue: https://github.com/elastic/elasticsearch/issues/126471
 
 # Examples:
 #

x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java

@@ -380,7 +380,7 @@ public void testGenerateMultipleCertificateWithNewCA() throws Exception {
             caDN = "CN=" + randomAlphaOfLengthBetween(3, 8);
             caYears = randomIntBetween(1, 3);
             caKeySize = randomFrom(2048, 3072, 4096);
-            caKeyUsage = randomSubsetOf(CertGenUtils.KEY_USAGE_MAPPINGS.keySet());
+            caKeyUsage = randomNonEmptySubsetOf(CertGenUtils.KEY_USAGE_MAPPINGS.keySet());
             terminal.addTextInput(caDN);
             terminal.addTextInput(caYears + "y");
             terminal.addTextInput(Integer.toString(caKeySize));