[bug-hunter] otlp_input_otel renders Bearer auth config without required credentials

## Impact
Users can enable Bearer Token auth in `otlp_input_otel` and get a rendered collector config that contains `bearertokenauth` but no `token`/`filename` credential. This produces an invalid auth extension configuration and can prevent the OTLP input from starting, blocking data ingestion.

## Reproduction Steps
1. Run this exact script locally:

```bash
work=/tmp/gh-aw/agent/repro-otlp-bearer
rm -rf "$work" && mkdir -p "$work" && cd "$work"
npm init -y >/dev/null 2>&1
npm install handlebars --silent >/dev/null 2>&1
cat > repro.js <<'JS'
const fs = require('fs');
const Handlebars = require('handlebars');

const tplPath = '/home/runner/work/integrations/integrations/packages/otlp_input_otel/agent/input/input.yml.hbs';
const tpl = fs.readFileSync(tplPath, 'utf8');
const data = {
enable_basic_auth: false,
enable_bearer_auth: true,
enable_oidc_auth: false,
bearer_token_header: 'Authorization',
bearer_token_scheme: 'Bearer',
grpc_endpoint: '0.0.0.0:4317'
};
const out = Handlebars.compile(tpl)(data);
const hasExt = /\bbearertokenauth:\s*/m.test(out);
const hasToken = /^\s*token:\s*\S+/m.test(out);
const hasFilename = /^\s*filename:\s*\S+/m.test(out);
console.log('--- Rendered output ---');
console.log(out);
console.log('--- Checks ---');
console.log(JSON.stringify({hasExt, hasToken, hasFilename}, null, 2));

if (hasExt && !hasToken && !hasFilename) {
console.error('FAIL: bearertokenauth rendered without required token or filename');
process.exit(1);
}
console.log('PASS');
JS
node repro.js
```

2. Observe the script exits with code `1`.

## Expected vs Actual
**Expected:** Enabling Bearer auth should either require `bearer_token` or `bearer_token_filename`, or avoid rendering `bearertokenauth` until one of them is present.

**Actual:** Template renders:

```yaml
extensions:
bearertokenauth:
header: Authorization
scheme: Bearer
```

with neither `token` nor `filename`, and the script fails with:

```text
FAIL: bearertokenauth rendered without required token or filename
```

## Failing Test
```js
const fs = require('fs');
const Handlebars = require('handlebars');

const tplPath = '/home/runner/work/integrations/integrations/packages/otlp_input_otel/agent/input/input.yml.hbs';
const tpl = fs.readFileSync(tplPath, 'utf8');
const data = {
enable_basic_auth: false,
enable_bearer_auth: true,
enable_oidc_auth: false,
bearer_token_header: 'Authorization',
bearer_token_scheme: 'Bearer',
grpc_endpoint: '0.0.0.0:4317'
};
const out = Handlebars.compile(tpl)(data);
const hasExt = /\bbearertokenauth:\s*/m.test(out);
const hasToken = /^\s*token:\s*\S+/m.test(out);
const hasFilename = /^\s*filename:\s*\S+/m.test(out);

if (hasExt && !hasToken && !hasFilename) {
throw new Error('bearertokenauth rendered without required token or filename');
}
```

## Evidence
- Manifest marks credential fields as optional while describing them as required when Bearer auth is enabled:
- `packages/otlp_input_otel/manifest.yml` lines 97-109 (`bearer_token`, `bearer_token_filename`)
- Template always renders `bearertokenauth` when `enable_bearer_auth` is true, independent of credential presence:
- `packages/otlp_input_otel/agent/input/input.yml.hbs` lines 13-30
- Existing open finding `#18745` tracks the Basic auth path (`htpasswd`); this report is the separate Bearer auth path.

> [!NOTE]
>
> 🔒 Integrity filter blocked 1 item
>
> The following item were blocked because they don't meet the GitHub integrity level.
>
> - [#17542](https://github.com/elastic/integrations/pull/17542) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Bug Hunter](https://github.com/elastic/integrations/actions/runs/25212642033)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 8, 2026, 11:37 AM UTC