OpenSearch addresses default to http and Basic credentials are registered for any host

## What happens
`OpenSearchConnection.getClient()` prefixes an address that has no scheme with `http://`. If `opensearch..user` and `opensearch..password` are set, the client sends Basic authentication over that plain connection with no complaint. The credentials are registered against `AuthScope.ANY`, so they are offered to any host, port and realm the client ends up talking to, including nodes discovered by the sniffer, which is on by default. `opensearch.disable.tls.validation` turns off certificate and hostname checking in one line and logs nothing when it is on.

## Where
`external/opensearch/src/main/java/org/apache/stormcrawler/opensearch/OpenSearchConnection.java:102-106` and `:151-153`. The same three things exist in `external/opensearch-java/src/main/java/org/apache/stormcrawler/opensearch/OpenSearchConnection.java:273-276` and `:356-362`, where the scope is `new AuthScope(null, -1)`.

```java
String scheme = "http";
// no scheme specified? use http
if (!host.startsWith(scheme)) {
host = "http://" + host;
}
```

```java
credentialsProvider.setCredentials(
AuthScope.ANY, new UsernamePasswordCredentials(user, password));
```

Config keys: `opensearch..addresses`, `opensearch..user`, `opensearch..password`, `opensearch..sniff`, `opensearch.disable.tls.validation`.

## Why it matters
The shipped `external/opensearch/opensearch-conf.yaml` puts `opensearch.user` and `opensearch.password` stubs directly under `opensearch.addresses: "http://localhost:9200"`, and `opensearch.indexer.addresses: "localhost"` has no scheme at all. An operator who fills in the credentials and moves the cluster to another host, without also editing the scheme, sends the password in cleartext on every bulk and status request. `AuthScope.ANY` widens that: the sniffer learns the node list over the same unauthenticated channel, and the credentials are then offered to whatever addresses come back. Every harmful case needs the operator to have left cleartext in place, and the shipped example is loopback, so this is about failing closed rather than about a default that is wrong on its own.

## Reproduction

Save as `external/opensearch/src/test/java/org/apache/stormcrawler/opensearch/OpenSearchConnectionCredentialsTest.java`.

```java
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to you under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package org.apache.stormcrawler.opensearch;

import static org.junit.jupiter.api.Assertions.assertNotEquals;

import java.util.HashMap;
import java.util.Map;
import org.junit.jupiter.api.Test;
import org.opensearch.client.Node;
import org.opensearch.client.RestHighLevelClient;

/**
* An address without a scheme is turned into an http:// one. Combined with opensearch.*.user and
* opensearch.*.password, that sends Basic credentials in the clear to a remote host.
*/
class OpenSearchConnectionCredentialsTest {

@Test
void credentialsAreNotSentOverPlainHttp() throws Exception {
Map conf = new HashMap<>();
conf.put("opensearch.indexer.addresses", "opensearch1.example.org:9200");
conf.put("opensearch.indexer.user", "crawler");
conf.put("opensearch.indexer.password", "s3cret");

try (RestHighLevelClient client = OpenSearchConnection.getClient(conf, "indexer")) {
for (Node node : client.getLowLevelClient().getNodes()) {
System.out.println("node: " + node.getHost());
assertNotEquals(
"http",
node.getHost().getSchemeName(),
"credentials configured, so the connection must not default to plain http");
}
}
}
}
```

Run it:

```
mvn -pl external/opensearch test -Dtest=OpenSearchConnectionCredentialsTest
```

It builds a client from a config with a scheme-less remote address plus user and password, and asserts the resulting node is not plain http. It fails on main. No server is contacted; the client is only constructed.

```
node: http://opensearch1.example.org:9200
[ERROR] Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
[ERROR] OpenSearchConnectionCredentialsTest.credentialsAreNotSentOverPlainHttp:44 credentials configured, so the connection must not default to plain http ==> expected: not equal but was:
```

## Suggested fix
In both `OpenSearchConnection` classes, refuse to start when a user and password are configured and the resulting scheme is http, with an exemption for loopback addresses so local development keeps working. Scope the credentials to the configured hosts instead of `AuthScope.ANY`, so a node address that arrives from sniffing does not automatically receive them. Log a warning when `opensearch.disable.tls.validation` is on. Change the shipped `opensearch-conf.yaml` and the archetype copy to show `https://` next to the credential stubs, and give every address an explicit scheme. Refusing to start is a behaviour change for anyone running credentials over http today, so it needs a release note.

Start with both OpenSearchConnection.java files and run OpenSearchConnectionCredentialsTest with the provided Maven command. Trace address scheme handling, credential scoping, TLS-validation configuration, and the two YAML templates. Done means credentialed remote HTTP connections fail safely, credentials are limited to configured hosts, TLS-validation disablement is logged, examples use explicit HTTPS schemes, and the behavior change is documented in release notes.

Written by the indexing model from the issue text.