opensearch: Dashboards authenticates as a user the chart's own security config removes #4210

Describe the bug

An OpenSearch release with dashboards.enabled: true runs a Dashboards pod that authenticates as a user the chart has deleted, so every request it makes to its own cluster is rejected.

packages/apps/opensearch/templates/security.yaml renders internal_users.yml with exactly one user, admin. The operator's securityconfig job runs securityadmin.sh -f <dir>/internal_users.yml -t internalusers, and that replaces the whole internalusers config type rather than merging into it, so the demo kibanaserver user that ships in the image is removed the first time the job runs.

On the other side, builders.NewDashboardsDeploymentForCR in opensearch-k8s-operator v2.8.0 (pkg/builders/dashboards.go:63-67) takes its else branch whenever spec.dashboards.opensearchCredentialsSecret is unset, and that branch sets OPENSEARCH_USERNAME and OPENSEARCH_PASSWORD to the literal kibanaserver. The chart never sets opensearchCredentialsSecret, and kibanaserver appears nowhere under packages/apps/opensearch/.

Neither half fails loudly. The securityadmin job reports success, because uploading the configuration did work, and the Dashboards pod reports a 401 that appears only in its own log.

Environment

• Cozystack main, 2026-09-10, opensearch-k8s-operator pinned at v2.8.0

To Reproduce

1. Create an OpenSearch application with dashboards.enabled: true
2. Wait for the securityconfig job to apply the chart's internal_users.yml
3. Read the Dashboards pod log

Expected behaviour

Dashboards authenticates against the cluster it belongs to.

Actual behaviour

It authenticates as kibanaserver, which the chart's own security configuration removed.

Additional context

Found while reviewing #2682 and verified against the pinned operator source and by grepping the chart. It predates that branch, which is only where it becomes conspicuous, since that is where Dashboards first gets its own certificate, its own TLS branch in the CR and a README operating procedure. Nothing in CI reaches it: the Chainsaw suite added there sets dashboards.enabled: false.

Either route closes it: add a kibanaserver entry to internal_users.yml with a generated password, or set spec.dashboards.opensearchCredentialsSecret to a Secret the chart already mints and stop depending on the demo user. Whichever is chosen needs a cluster test with Dashboards enabled, because no render test can see this.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs