REDHAT-BUG-2527075: High severity Ansible automation-controller vulnerability

A flaw was found in automation-controller (AWX). InventorySourceOptions. sourcevars (awx/main/models/inventory.py) is declared as a plain TextField without a preventsearch() wrapper, unlike protected fields such as CustomInventoryScript.script and Credential.inputs. django-ansible-base's FieldLookupBackend permits contains/icontains/startswith/regex lookups that traverse model joins without per-hop RBAC. Because the credentialtypes list endpoint is readable by any authenticated user, an attacker holding zero roles/organization/superuser/auditor privileges -- who is correctly denied on the inventorysources endpoints -- can query credentialtypes?credentialsorganizationinventoriesinventorysources sourcevarscontains=<needle> (and the inventoryupdates variant) and read the result count as a boolean oracle (count>0 iff some tenant's sourcevars contains the needle). Using regex the full plaintext is recovered efficiently. sourcevars is the documented location for inline dynamic- inventory-plugin authentication (e.g. awsaccesskey/awssecretkey, subscriptionid/clientid/secret/tenant, username/password, token, apikey), so the flaw discloses cross-tenant cloud-provider credentials to a zero- privilege user. The field is defined on InventorySourceOptions and inherited by InventorySource and InventoryUpdate. This is an instance of a broader class in which unfiltered FieldLookupBackend joins on the globally-readable credentialtypes list reach fields lacking preventsearch. Discovered internally; verified live on AAP 2.7 / automation-controller 4.8.1. Upstream: github.com/ansible/awx (main/models/inventory.py) + django-ansible-base (FieldLookupBackend)