[bug-hunter] otlp_input_otel OIDC auth renders invalid config without required fields

## Impact
Users can enable OIDC auth in `otlp_input_otel` and get a rendered collector config with `extensions.oidc` but without `issuer_url` and `audience`. This produces an invalid OIDC authenticator configuration and can prevent the OTLP input from starting, blocking ingestion.

## Reproduction Steps
1. Run this exact script:

```bash
set -euo pipefail
work=/tmp/gh-aw/agent/repro-otlp-oidc
rm -rf "$work" && mkdir -p "$work" && cd "$work"
npm init -y >/dev/null 2>&1
npm install handlebars@4 --silent >/dev/null 2>&1
node - <<'JS'
const fs = require('fs');
const Handlebars = require('handlebars');

const tplPath = '/home/runner/work/integrations/integrations/packages/otlp_input_otel/agent/input/input.yml.hbs';
const tpl = fs.readFileSync(tplPath, 'utf8');
const data = {
enable_basic_auth: false,
enable_bearer_auth: false,
enable_oidc_auth: true,
oidc_ignore_audience: false,
grpc_endpoint: '0.0.0.0:4317',
http_endpoint: '0.0.0.0:4318'
};
const out = Handlebars.compile(tpl)(data);

const hasOidc = /^\s*oidc:\s*$/m.test(out) || /^\s*oidc:\s*\n/m.test(out);
const hasIssuer = /^\s*issuer_url:\s*\S+/m.test(out);
const hasAudience = /^\s*audience:\s*\S+/m.test(out);

console.log('--- Rendered output (excerpt) ---');
console.log(out.split('\n').slice(0,30).join('\n'));
console.log('--- Checks ---');
console.log(JSON.stringify({hasOidc, hasIssuer, hasAudience}, null, 2));

if (hasOidc && (!hasIssuer || !hasAudience)) {
console.error('FAIL: oidc auth rendered without required issuer_url/audience');
process.exit(1);
}

console.log('PASS');
JS
```

## Expected vs Actual
**Expected:** When `enable_oidc_auth: true`, rendered config should include required `issuer_url` and `audience` (or the package should enforce those fields before rendering).

**Actual:** Template renders `oidc` auth without either required field, and the script exits with:

```text
FAIL: oidc auth rendered without required issuer_url/audience
```

## Failing Test
```js
const fs = require('fs');
const Handlebars = require('handlebars');

const tplPath = '/home/runner/work/integrations/integrations/packages/otlp_input_otel/agent/input/input.yml.hbs';
const tpl = fs.readFileSync(tplPath, 'utf8');
const data = {
enable_basic_auth: false,
enable_bearer_auth: false,
enable_oidc_auth: true,
oidc_ignore_audience: false,
grpc_endpoint: '0.0.0.0:4317',
http_endpoint: '0.0.0.0:4318'
};
const out = Handlebars.compile(tpl)(data);

const hasOidc = /^\s*oidc:\s*$/m.test(out) || /^\s*oidc:\s*\n/m.test(out);
const hasIssuer = /^\s*issuer_url:\s*\S+/m.test(out);
const hasAudience = /^\s*audience:\s*\S+/m.test(out);

if (hasOidc && (!hasIssuer || !hasAudience)) {
throw new Error('oidc auth rendered without required issuer_url/audience');
}
```

## Evidence
- `packages/otlp_input_otel/manifest.yml:105-124` says OIDC fields are required when OIDC auth is enabled, but both are currently `required: false`.
- `packages/otlp_input_otel/agent/input/input.yml.hbs:32-46` always renders `extensions.oidc` when `enable_oidc_auth` is true, while `issuer_url` and `audience` are only conditionally emitted.
- Existing open findings track related auth paths (`#18745` basic auth, `#18761` bearer auth), but not this OIDC path.

> [!NOTE]
>
> 🔒 Integrity filter blocked 1 item
>
> The following item were blocked because they don't meet the GitHub integrity level.
>
> - [#17542](https://github.com/elastic/integrations/pull/17542) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Bug Hunter](https://github.com/elastic/integrations/actions/runs/25316674801)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 11, 2026, 11:46 AM UTC