fix(telemetry): harden Checkmarx-flagged execution paths

[balajikumaran-c-s]

PR Description

Description of the Solution

Summary: This PR hardens telemetry validation and omnia_auto execution paths identified by Checkmarx. It validates untrusted host and path values before process execution, improves sensitive-file and credential handling, removes shell-based command composition where possible, and hardens OME test-automation command arguments. The PR remains a draft because real ansible-vault smoke validation currently exposes the credential-encryption regression documented in the Testing section.

Changes

Telemetry Input Validation

• Canonicalized Kubernetes VIP values before SSH execution and rejected malformed, option-like, non-ASCII, hostname, and IPv6 inputs.
• Required k8s_cluster_mount to be an absolute path without NUL, carriage-return, or newline characters.
• Added defensive parsing for malformed cluster-inventory structures.
• Replaced dynamically assembled SSH execution with fixed argument lists, shell=False, an option terminator, and explicit timeouts.
• Transported remote mount paths through stdin to a fixed remote command instead of embedding them in command text.

omnia_auto Process and Credential Security

• Added shared helpers for sensitive-file validation, private permissions, protected file descriptors, atomic output replacement, password pipes, and subprocess-environment scrubbing.
• Rejected symlinked, non-regular, foreign-owned, and otherwise unsafe credential and Vault-key files.
• Moved sshpass passwords from command-line arguments to inherited file descriptors for remote playbook, clone, copy, and synchronization operations.
• Created Testinfra inventories in private temporary directories with restricted permissions and cleanup handling.
• Restricted config-driven commands, scenarios, suites, and marker expressions to validated values.
• Replaced shell-based pytest invocation and tee pipelines with argument-list execution and Python-managed output streaming.

OME Validation Automation

• Passed dynamic OME API, certificate, path, credential, and JSON values through Testinfra-quoted arguments instead of interpolating them into shell templates.
• Constructed OME request bodies with JSON serialization.
• Removed duplicate OME and OpenSSL command templates from common variables and retained the component-specific definitions.
• Added focused OME regression cases for hostile credential, passphrase, path, and payload values.

Packaging and Regression Coverage

• Updated the tracked omnia_auto wheel so its six remediated modules match the source implementation.
• Added regression coverage for sensitive-file handling, SSH password descriptors, private inventories, command allowlists, environment restoration, and shell-free pytest execution.
• Updated telemetry test setup to load the local plugin implementation and safely close the stdin-redirection descriptor.

Files Changed

File	Change Type	Description
src/telemetry/plugins/module_utils/input_validation/messages/en_us_validation_msg.py	Modified	Added the invalid Kubernetes mount-path message.
src/telemetry/plugins/module_utils/input_validation/schema/telemetry_packages.json	Modified	Enforced an absolute, control-character-free Kubernetes mount path.
src/telemetry/plugins/module_utils/input_validation/validators/telemetry_validation.py	Modified	Hardened VIP, inventory, mount-path, and SSH handling.
test/plugins/omnia_auto/functions/process_security.py	Added	Centralized sensitive-file, descriptor, password-pipe, and environment helpers.
test/plugins/omnia_auto/functions/credential_func.py	Modified	Hardened Vault keys, credential reads/writes, prompts, and encryption execution.
test/plugins/omnia_auto/functions/host_func.py	Modified	Hardened Vault operations and private Testinfra inventory creation.
test/plugins/omnia_auto/functions/runner_func.py	Modified	Passed SSH passwords through file descriptors during remote playbook execution.
test/plugins/omnia_auto/functions/sync_func.py	Modified	Hardened SSH, SCP, rsync, and remote clone credential handling.
test/plugins/omnia_auto/functions/validation_runner.py	Modified	Added command allowlists and shell-free pytest execution and logging.
test/plugins/test_security_remediation.py	Added	Added focused regression coverage for the omnia_auto security boundaries.
test/plugins/dist/omnia_auto-1.0.0-py3-none-any.whl	Modified	Rebuilt the tracked wheel with the remediated plugin modules.
test/telemetry/conftest.py	Modified	Preferred local plugin source and safely managed stdin redirection.
test/telemetry/library/functions/ome_func.py	Modified	Separated dynamic OME/OpenSSL values from command templates.
test/telemetry/library/vars/common_vars.py	Modified	Removed duplicate OME/OpenSSL command templates.
test/telemetry/library/vars/ome_vars.py	Modified	Converted OME/OpenSSL templates to quoted positional arguments.
test/telemetry/ut/test_ome_func.py	Modified	Updated and expanded OME argument-safety regression tests.

Testing

• pytest -p no:cacheprovider -q test/telemetry/ut: 29 passed; report output produced a non-fatal warning because /opt/omnia/reports was read-only in the audit environment.
• pytest -p no:cacheprovider -q test/plugins/test_security_remediation.py: 51 passed, 1 failed. The failing case is test_credentials_have_private_mode_before_yaml_write.
• Real ansible-vault smoke validation with ansible-core 2.21.3 currently fails in both vault_encrypt() and write_credential_fields(): the descriptor-backed output is not populated, and the unlinked temporary plaintext path cannot be reopened by ansible-vault.
• git diff --check 8ef1af50a..d942e5ae4: passed.
• Checkmarx and full end-to-end telemetry/OME/SSH validation were not run.

Backward Compatibility

• Existing valid IPv4 and absolute mount-path configurations remain supported; hostnames, IPv6 values, relative mount paths, and control-character inputs are now rejected.
• Sensitive credential and Vault-key paths must now be regular, non-symlink files owned by the current user, and atomic-output parent directories cannot be group/world writable.
• The descriptor implementation relies on supported Linux/POSIX facilities such as /proc/self/fd, pass_fds, and dir_fd.
• The current ansible-vault encryption regression is a merge blocker and must be corrected before this change can be considered backward compatible or production-ready.

Suggested Reviewers

@reviewer1 @reviewer2