[random test failure] Random failure in CommentStatisticsTest

Problem/Motivation

https://www.drupal.org/pift-ci-job/866534
https://www.drupal.org/pift-ci-job/991286

1) Drupal\Tests\comment\Functional\CommentStatisticsTest::testCommentNodeCommentStatistics
The value of node last_comment_name is the name of the anonymous user.
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
-'hFpV0qnB'
+''

/var/www/html/vendor/phpunit/phpunit/src/Framework/Constraint/Equality/IsEqual.php:96
/var/www/html/core/modules/comment/tests/src/Functional/CommentStatisticsTest.php:121
/var/www/html/vendor/phpunit/phpunit/src/Framework/TestResult.php:728

https://www.drupal.org/pift-ci-job/2692252

Steps to reproduce

The fact that this one didn't occur for a long time immediately points to a timing issue.
We went to faster test instances (and it dissappeared) and after that we're on slower instances now.

I dabbled with this one for quite a while and can't really pin down _where_ the timing issue occurs.
Somewhere else, I dumped the node comment list when the test fails.

The relevant bit:

  #list: array:1 [
    0 => Drupal\comment\Plugin\Field\FieldType\CommentItem {#4072
      #definition: Drupal\Core\Field\TypedData\FieldItemDataDefinition {#4911}
      #name: 0
      #parent: Drupal\comment\CommentFieldItemList {#7857}
      #_serviceIds: []
      #_entityStorages: []
      #stringTranslation: null
      #typedDataManager: Drupal\Core\TypedData\TypedDataManager {#5039}
      #values: array:6 [
        "status" => "2"
        "cid" => "1"
        "last_comment_timestamp" => "1687262036"
        "last_comment_name" => ""
        "last_comment_uid" => "4"
        "comment_count" => "2"
      ]
      #properties: []
    }
  ]

So somehow when it goes wrong, the last comment is tributed to uid 4, which is $this->webUser2 in the test.

Asserting that that user, which logs in to make the first comment and then logs out, is not still logged in always passes, so the timing issue lays elsewhere.

Deleting caches also didn't help.

Proposed resolution

We're testing a rare occurence where a user logs in, makes a comment, logs out, comment settings are changed, logged out user makes a comment, comment settings are changed again and the same anon-user comments again.

These setting changes are done directly using user_role_change_permissions.

I found that actually logging in, and change the permissions using "/admin/people/permissions" doesn't fail randomly.

If this is because of the extra delay that this causes or something else is a mystery to me.

Remaining tasks

Looking at this test, there's nothing in it that actually uses asserts against the actual forms/screens/whatever.
It solely tests (posted) comments and the node they belong to.

Therefore, IMHO this should be a Kernel test.

I would like some confirmation on that, and if it should be, open a follow-up for that.