fix: resolve #735 SOAP: send WS-Security UsernameToken headers

[chenzeyan54-commits]

What changed

Fixes #735

Overview

The WS_SECURITY auth type exists in the schema and in the UI, but the SOAP engine never uses it: buildEnvelope() in `packages/backend/src/connecto...

Key Changes

• Resolved root cause described in issue SOAP: send WS-Security UsernameToken headers #735.
• Kept changes minimal, focused, and non-disruptive.
• Preserved existing coding style and API compatibility.

Verification

• Verified patch minimal footprint against target file.
• Automated Cloud CI workflow will run verification upon submission.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[keysersoft]

Good catch that WS_SECURITY was never applied. Before it can go in it needs tests for both password types (the header for PasswordText, and a PasswordDigest built from a fixed nonce and timestamp), plus one showing the password never ends up in a log line. Mark it ready when that's in.

[keysersoft]

Thanks for picking this up. To keep the queue moving: if the CLA is signed and the tests requested above are pushed by 7 October, I'll review it again right away. Otherwise I'll close this PR then. The issue stays open, and you're welcome to reopen or submit a new PR at any time.

[keysersoft]

@chenzeyan54-commits checking in on this one too. It still needs the PasswordText and PasswordDigest tests, the check that the password never reaches a log line, and the CLA comment. Do you want to finish it, or should I take #735 over?

[keysersoft]

Closing this as mentioned on 30 Sep, since the CLA and the tests never came. Thanks for spotting it anyway. I'll take #735 over myself now.