opensearch: per-user Secret names collide across releases because the username is a free key #4116

Describe the bug
packages/apps/opensearch/templates/users.yaml renders one Secret per user as {{ .Release.Name }}-user-{{ }}, and users in values.schema.json is an object with additionalProperties and no key pattern, so the tail of the Secret name is a free string the tenant chooses. Application x with a user named http-server and application x-user with TLS enabled both write opensearch-x-user-http-server.

The dot-separated suffixes from #2682 do not cover this family: that argument rests on application names being DNS-1035 labels, and a user key is not one; it may even contain a dot.

Environment

• Cozystack main with feat(opensearch)!: issue HTTP and Dashboards certificates from cert-manager #2682, 2026-09-07

To Reproduce

1. helm template x packages/apps/opensearch --set 'users.http-server.roles={admin}' and helm template x-user packages/apps/opensearch --set tls.enabled=true --set external=true into one namespace
2. opensearch-x-user-http-server is in both outputs

Expected behaviour
No Secret name of one release can be produced by another release of the same chart.

Actual behaviour
Two releases write the same object.

Additional context
Closing it needs a pattern on the user key, which is a breaking schema change and out of scope for #2682; that PR states the residual risk in the header of templates/certmanager.yaml. Same family as #4065.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs