Custom appliance credentials are incorrectly reused for vCenter discovery

ArcOnAVS 2.0.28 incorrectly reuses config_avs.json applianceCredentials for vCenter GOVC discovery. When applianceCredentials contains a username and password, DataCollector._collect_customer_credentials() returns those values as the shared customer_credentials object and bypasses the intended CredentialsRetriever/listAdminCredentials path. That same object is then passed to VSphereDetails.retrieve_data(), where the credentials are written to GOVC_USERNAME and GOVC_PASSWORD.

When valid local appliance credentials are supplied, vCenter authentication fails because those credentials are not valid for vCenter. The GOVC wrapper returns (None, 1), does not capture the actionable stderr output, and _retrieve_data_stores() calls json.loads(None) before checking the error status. The resulting error is therefore the misleading exception: TypeError: the JSON object must be str, bytes or bytearray, not NoneType.

The credential flow was validated by running govc about and govc find -type s -json=true directly with valid AVS CloudAdmin credentials, which successfully returned vCenter and datastore information. As a temporary workaround, placing the same AVS CloudAdmin credentials in applianceCredentials allowed ArcOnAVS onboarding to advance beyond datastore discovery. This confirms that the field intended for the appliance account is being used by the vCenter discovery path.

Requested correction: maintain separate appliance_credentials and vcenter_credentials objects; use credentials obtained through listAdminCredentials exclusively for GOVC and vSphere inventory operations; use applianceCredentials only for the appliance-local account; capture and sanitize GOVC stderr; and check the GOVC exit status and empty output before attempting JSON parsing. No secrets or environment-specific identifiers are included in this report.

Start with DataCollector._collect_customer_credentials() and trace customer_credentials into VSphereDetails.retrieve_data() and _retrieve_data_stores(). Verify CredentialsRetriever/listAdminCredentials supplies vCenter credentials, then exercise govc about and govc find -type s -json=true; done means separate credential objects, sanitized stderr, and status/output checks before JSON parsing.

Written by the indexing model from the issue text.