[NavidSassan]

mongodb-dump passed the password of the dump user to mongosh and mongodump on the command line, where every local user can read it in the process list. Follows #505 (same for MariaDB) and #509 (dropped MongoDB < 7.0, so no fallback for the legacy mongo shell or a mongodump without --config is needed).

fix(roles/mongodb): keep the dump password off the command line

• The password moves from /etc/mongodb-dump.conf to /etc/mongodb-dump-login.json ({"password": ...}, 0600). mongodump reads it with --config, which rejects any other key, so the user name stays in mongodb-dump.conf. mongosh reads it in JavaScript (require("fs")) and logs in with db.auth(); the user name comes through the environment instead of being quoted into the JavaScript.
• The legacy mongo fallback is gone.
• Fixed in the rewritten lines: mongodb__dump_only_if_hidden skipped hidden members instead of non-hidden ones, and grepped for the legacy shell's output format, so it never matched with mongosh and every member was dumped. A failing mongodump printed an error but the script still exited 0.
• New Molecule scenario mongodb (no scenario existed): authorization on, a dump password with \ " # ' : @ / and %, verifies that the dump contains a test database.

fix(roles/mongodb): stop reporting unchanged MongoDB users as changed

The new scenario failed idempotence: mongodb_user with update_password: always reports a change on every run, on_create never applies a changed password. A read-only pymongo login with the inventory password (JSON on stdin, no_log) decides: always only if the login fails (AuthenticationFailed, also for a user that does not exist yet), else on_create. Applied to the dump user and to mongodb__users__*_var.

Verified:

• Container, Rocky 9, MongoDB 8.0, mongosh 2.14, database-tools 100.20: special-character password, wrong password fails with exit 1, hidden check skips a non-hidden member, path without authorization.
• Molecule mongodb on Debian 12, Rocky 8, 9, 10, Ubuntu 22.04 and 24.04: converge, verify, idempotence, verify.
• On Rocky 9, Debian 12 and Ubuntu 24.04: converge with a changed dump password updates the user and the login file, the dump works with the new password, and converging back works the same.

Not changed, but found: with authorization, the file-based method cannot lock the instance, since the dump user only has the backup role, which lacks fsync (not authorized on admin to execute command { fsync: 1, lock: true }). The script then copies /var/lib/mongo without the lock and fails at the unlock (exit 3).