[bug-hunter] kafka_input_otel auth passwords are rendered unescaped and break YAML parsing

## Impact
Users configuring `kafka_input_otel` with SASL or Kerberos passwords that start with YAML-special content (for example `#`) can have credentials parsed incorrectly, causing authentication failure and ingestion outage for that input.

## Reproduction Steps
1. Confirm the unescaped template fields in the package:
- `packages/kafka_input_otel/agent/input/input.yml.hbs:116` -> `password: \{\{sasl_password}}`
- `packages/kafka_input_otel/agent/input/input.yml.hbs:136` -> `password: \{\{kerberos_password}}`
2. Run this new minimal repro script:

```python
from pathlib import Path
import yaml

REPO_TEMPLATE = Path(
"/home/runner/work/integrations/integrations/packages/kafka_input_otel/agent/input/input.yml.hbs"
)

def parse_rendered_password(raw_password: str) -> str | None:
template = REPO_TEMPLATE.read_text()
marker = " password: \{\{sasl_password}}"
assert marker in template, "Expected kafka_input_otel template marker missing"
rendered_line = marker.replace("\{\{sasl_password}}", raw_password)
rendered = f"auth:\n sasl:\n{rendered_line}\n"
return yaml.safe_load(rendered)["auth"]["sasl"]["password"]

def main() -> None:
raw = "#abc123"
actual = parse_rendered_password(raw)
expected = raw
print(f"rendered raw value: {raw!r}")
print(f"yaml parsed value: {actual!r}")
if actual != expected:
raise AssertionError(
f"Kafka template-style unquoted password is lossy: expected {expected!r}, got {actual!r}"
)

if __name__ == "__main__":
main()
```

3. Execute:

```bash
python /tmp/gh-aw/agent/repro_kafka_input_otel_password_yaml.py
```

## Expected vs Actual
**Expected:** Password value remains the exact configured string (for example `#abc123`).

**Actual:** YAML parses unescaped `#abc123` as comment, resulting in `None`.

Actual output:

```text
rendered raw value: '#abc123'
yaml parsed value: None
Traceback (most recent call last):
File "/tmp/gh-aw/agent/repro_kafka_input_otel_password_yaml.py", line 32, in
main()
File "/tmp/gh-aw/agent/repro_kafka_input_otel_password_yaml.py", line 26, in main
raise AssertionError(
AssertionError: Kafka template-style unquoted password is lossy: expected '#abc123', got None
```

## Failing Test
The repro script above is a minimal failing test for this bug.

## Evidence
- `packages/kafka_input_otel/agent/input/input.yml.hbs:116`
- `packages/kafka_input_otel/agent/input/input.yml.hbs:136`
- Related recent precedent fixing the same bug class in another integration: commit `faa758aa672c0edaf903f96d4d7b9a2dd728f684` (`[Elasticsearch] Fix authentication failure when password contains YAML special characters`) which switched to `\{\{escape_string password}}`.
- No matching open issue found for `kafka_input_otel` password YAML escaping in current issue search; no merged PR found fixing this exact package path.

## Suggested Actions
- [ ] Escape `sasl_password` and `kerberos_password` in `packages/kafka_input_otel/agent/input/input.yml.hbs` (for example with `escape_string`).
- [ ] Add a minimal policy/template rendering test that includes YAML-special password characters (e.g. `#`, `"`, `:`) and asserts value preservation.

> [!NOTE]
>
> 🔒 Integrity filter blocked 14 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#18434](https://github.com/elastic/integrations/issues/18434) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18291](https://github.com/elastic/integrations/issues/18291) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18265](https://github.com/elastic/integrations/issues/18265) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#14030](https://github.com/elastic/integrations/issues/14030) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18164](https://github.com/elastic/integrations/issues/18164) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#17816](https://github.com/elastic/integrations/issues/17816) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#17846](https://github.com/elastic/integrations/issues/17846) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18569](https://github.com/elastic/integrations/issues/18569) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#15818](https://github.com/elastic/integrations/issues/15818) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#17815](https://github.com/elastic/integrations/issues/17815) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#17818](https://github.com/elastic/integrations/issues/17818) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18096](https://github.com/elastic/integrations/issues/18096) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18810](https://github.com/elastic/integrations/issues/18810) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18841](https://github.com/elastic/integrations/issues/18841) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Bug Hunter](https://github.com/elastic/integrations/actions/runs/25493313066)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 14, 2026, 11:52 AM UTC