[patriiciacoboss]

Description

Related to #2792

When resolve-credentials.sh --prestart refuses to start, the Wazuh indexer entrypoint always ended with a message that sent the user to config/credentials/indexer.env and to credentials-conf.sh, even when the lines above it were about certificate files, for example UNSAFE .../certs/indexer.pem: owned by uid 101, not root. The Wazuh manager entrypoint already says that the problems above must be solved. This PR makes the indexer message cover both kinds of problem.

Changes

• build-docker-images/wazuh-indexer/config/entrypoint.sh: replace the two closing lines of the --prestart block with three that follow the manager entrypoint: the problems above must be solved, passwords go in config/credentials/indexer.env, and the certificates under config/*/certs, and any file that is mounted, must be owned by root and not writable by group or others. It does not name config/wazuh_indexer/certs, which exists only in the single-node stack, or group 101, which the resolver does not check. The branch for missing keys is unchanged.
• CHANGELOG.md: add the entry under v5.0.0 > Fixed.

Tests

• bash -n on the modified entrypoint.
• With the published image wazuh/wazuh-indexer:5.0.0-rc2 (its /entrypoint.sh has the same lines 98-111 as 5.0.0), this entrypoint mounted over it and throwaway certificates owned by uid 101 mounted in /usr/share/wazuh-indexer/config/certs: the container prints one UNSAFE ... owned by uid 101, not root line per file, the resolve-credentials line and the three new lines, and exits with 1.
• With the same files owned by root, no UNSAFE line and no closing message are printed, and the entrypoint goes on and starts OpenSearch, which then stops by itself, outside of this change.

[fcaffieri]

LGTM. The closing lines now point to the problems above for passwords and certificates alike, match the manager and dashboard wording, and describe what the resolver checks (root owner, no group/other write).

1. The issue suggested adding the group and certificates-conf.sh --priv. When the prestart check fails on UNSAFE, the resolver stops before its own chown root:wazuh-indexer, chmod 0640 hint, so someone following this message could set root:root and then hit a read error in OpenSearch. Would it make sense to add something like "(certificates-conf.sh --priv sets them: root, group 101, 0640)"?