Enable `secret: true` for sensitive fields in OTel input packages

## Background

Several OTel input packages intentionally set `secret: false` on sensitive credential fields as a workaround for [elastic/fleet-server#6277](https://github.com/elastic/fleet-server/issues/6277), which caused secret handling to break when Fleet Server provisioned OTel-based inputs. That issue has since been resolved.

Each affected field carries a `TODO` comment pointing to the fleet-server issue:

```yaml
# TODO: Change to secret: true once Fleet Server resolves the secret handling issue
# for OTel input packages. See: https://github.com/elastic/fleet-server/issues/6277
secret: false
```

## Kibana version constraint

The fix is available starting from:

- **9.2.7** (patch backport)
- **9.3.2** (patch backport)
- **9.4.0+** (all subsequent releases)

Each updated package must bump its `kibana.version` constraint to `^9.2.7 || ^9.3.2 || ^9.4.0` so that the secret masking UI is guaranteed to be present.

Reference: [`docs/extend/otel-input-packages.md`](../docs/extend/otel-input-packages.md) (line ~200).

## Packages to update

| Package | File | Fields |
|---|---|---|
| `redis_input_otel` | `packages/redis_input_otel/manifest.yml` | `password` |
| `mysql_input_otel` | `packages/mysql_input_otel/manifest.yml` | `password`, `allow_native_passwords` |
| `prometheus_input_otel` | `packages/prometheus_input_otel/manifest.yml` | `password`, `bearer_token` |
| `prometheus_input_otel_raw` | `packages/prometheus_input_otel_raw/manifest.yml` | `bearer_token` |
| `sql_server_input_otel` | `packages/sql_server_input_otel/manifest.yml` | `password` (appears twice) |

## Work items

### Per-package checklist (repeat for each package above)

- [ ] Set `secret: true` on all listed fields and remove the TODO comment
- [ ] Update the `kibana.version` constraint to `^9.2.7 || ^9.3.2 || ^9.4.0`
- [ ] Bump the package version (patch)
- [ ] Add `CHANGELOG.md` entry: _"Enable `secret: true` for sensitive fields, supported from Kibana 9.2.7 / 9.3.2 / 9.4.0"_
- [ ] Run `elastic-package lint` and `elastic-package format` — no errors
- [ ] Run pipeline / system tests and confirm they pass

### Release checklist

- [ ] Change follows the [contributing guidelines](https://github.com/elastic/integrations/blob/main/CONTRIBUTING.md)
- [ ] Required Kibana version set to `^9.2.7 || ^9.3.2 || ^9.4.0` in every updated package
- [ ] At least a manual test with ES / Kibana / Agent has been performed (verify the field is masked in Fleet UI)
- [ ] Documentation updated if the supported-versions section needs to reflect the new minimum Kibana version

## Out of scope

The following packages also have `secret: false` but are **not** covered by this issue:

- `apm` — blocked by a separate upstream issue ([elastic/apm-server#11450](https://github.com/elastic/apm-server/issues/11450))
- `otlp_input_otel` — fields are non-sensitive config strings (`bearer_token_file`, `bearer_token_header`, `bearer_token_scheme`); `secret: false` is intentional

Read docs/extend/otel-input-packages.md around the supported Kibana versions, then inspect the five listed packages' manifest.yml files and their CHANGELOG.md files. Update every named field and version constraint, bump each package patch version, and run elastic-package lint, elastic-package format, and the pipeline or system tests. Done means the checks pass and the sensitive fields are masked in a manual ES/Kibana/Agent Fleet UI test.

Written by the indexing model from the issue text.