Add XUSER authentication for MaxDB (closes #2)

[Simon0Harms]

Add XUSER authentication for MaxDB (closes #2)

Summary

Adds the option to authenticate against the MaxDB via an XUSER key
(dbmcli -U <key>) instead of a username/password pair. When an XUSER key is
configured, no plaintext credentials are written to maxdb.cfg, which resolves
the concern raised in issue #2.

The change is fully backward compatible: existing configurations that use
user/password continue to work unchanged. XUSER is opt-in and, when set,
takes precedence.

Motivation

Previously the agent plugin built the connection as
dbmcli -d <db> -u <user>,<password>, and the bakery wrote both user and
password in clear text into ${MK_CONFDIR}/maxdb.cfg. On production hosts a
plaintext DB password in an agent config file is undesirable. MaxDB's native
XUSER mechanism stores the credentials in the OS user's protected XUSER store,
so the agent only needs to reference a key name.

Changes

• Agent plugin (share/check_mk/agents/plugins/maxdb.py): if xuser_key
  is present in a section, the command becomes dbmcli -U <key>; otherwise the
  classic -d <db> -u <user,password> is used. The key is validated against
  ^[A-Za-z0-9_.-]+$ before use to avoid injecting unexpected arguments.
• Bakery (lib/check_mk/base/cee/plugins/bakery/maxdb.py): emits
  xuser_key= into maxdb.cfg when configured, otherwise user=/password=
  as before. Reads credentials from the new nested auth dict, with a fallback
  to the flat layout for older rule data.
• WATO rule (share/check_mk/web/plugins/wato/agent_bakery_maxdb.py):
  replaces the fixed username/password fields with an Alternative valuespec
  offering either "XUSER key (no plaintext password)" or "User and password
  (clear text in maxdb.cfg)".

Configuration example (maxdb.cfg)

XUSER (new):

[CSP]
xuser_key=MONCSP
cmd_tool=/sapdb/programs/bin/dbmcli
timeout=20
modules=['state', 'backup:sep(124)', 'data:sep(61)']

User/password (unchanged, still supported):

[CSP]
user=MONITOR
password=secret
cmd_tool=/sapdb/programs/bin/dbmcli
...

The XUSER key must be created beforehand for the OS user that runs the Checkmk
agent, e.g.:

xuser set -U MONCSP -d CSP -n <dbhost> -u MONITOR,secret

Testing

• python3 -m py_compile passes for the agent and bakery modules; the WATO
  file parses via ast.parse (it imports cmk GUI modules only available inside
  a site, so it cannot be byte-compiled standalone).
• Verified both auth branches build the expected dbmcli argument list and that
  an invalid key (containing spaces/;) is rejected before execution.

Notes for maintainer

• Bump the version and rebuild the .mkp as usual.
• If desired, the user/password branch could later be marked deprecated in
  the WATO help text once XUSER adoption is confirmed.