[kathap]

• A short explanation of the proposed change:
  Remove cc.staging_upload_user and cc.staging_upload_password from all capi-release job templates (cloud_controller_ng, cloud_controller_worker, cloud_controller_clock, cc_deployment_updater) and their job specs. The staging.auth block is no longer emitted in any generated config.
• An explanation of the use cases your change solves
  The staging.auth credential protected CC's local blobstore download endpoints (/staging/, /v2/buildpacks//download) so Diego cells could download packages, droplets and buildpacks directly from CC. This code path is only active when LocalClient is used, i.e. when blobstore_type: local or local-temp-storage is configured (LocalClient#local? returns true). The local blobstore only makes sense for single-instance local development; it cannot be shared across multiple CC instances in a real BOSH deployment. All supported BOSH deployments use storage-cli (e.g. DAV, Azure, S3), where StorageCliClient#local? returns false and the staging auth code path is never reached. Additionally, client_provider.rb explicitly rejects blobstore_type: webdav with an error.

The credential is therefore unreachable on any currently-supported BOSH blobstore configuration. Removing it from the job specs and templates eliminates a mandatory property with no effect, allowing operators to clean their deployment manifests. Local dev setups that still need staging.auth continue to work, the ccng config schema has been made optional in a companion change.

• Links to any other associated PRs
  Make staging.auth optional instead of mandatory cloud_controller_ng#5567

• I have viewed signed and have submitted the Contributor License Agreement

• I have made this pull request to the develop branch

• I have run CF Acceptance Tests on bosh lite