manage edge bgp_password: honor boolean, validate password required when enabled

- Template: if bgp_password_enable is true, send password; if false, send empty password
- Validation: rule 321 now rejects bgp_password_enable=true without a non-empty bgp_password
- Always emit BGP_PASSWORD key for dcnm_policy diff detection

Author: ccoueffe

roles/dtc/common/templates/ndfc_edge_connections.j2

@@ -17,10 +17,11 @@
           description: {{ 'nace_bgp_peer_template_dci_underlay_jython_' + link.source_device + '_' + link.source_interface + '_' + link.dest_device }}
           name: bgp_peer_template_dci_underlay_jython
           policy_vars:
-{% if link.bgp_section is defined and link.bgp_section.bgp_password is defined and link.bgp_section.bgp_password is not none and link.bgp_section.bgp_password | length > 0 %}
-            BGP_PASSWORD_ENABLE: true
+{% if link.bgp_section.bgp_password_enable | default(defaults.vxlan.topology.edge_connections.bgp_section.bgp_password_enable) | bool %}
             BGP_PASSWORD: "{{ link.bgp_section.bgp_password }}"
+            BGP_PASSWORD_ENABLE: true
 {% else %}
+            BGP_PASSWORD: ""
             BGP_PASSWORD_ENABLE: false
 {% endif %}
             TEMPLATE_NAME: {{ data_model_extended.vxlan.fabric.name + '-' + link.dest_fabric + '-IPV4-EBGP' }}

roles/validate/files/rules/common/321_topology_edge_connections.py

@@ -1,6 +1,6 @@
 class Rule:
     id = "321"
-    description = "Verify edge connections have valid source devices and interfaces"
+    description = "Verify edge connections have valid source devices, interfaces, and bgp password configuration"
     severity = "HIGH"
 
     @classmethod
@@ -42,6 +42,26 @@ def match(cls, data_model):
                     f"vxlan.topology.edge_connections.{source_device} source_interface must not contain a '.' (sub-interfaces are not allowed)."
                 )
 
+            # Verify bgp_password is provided when bgp_password_enable is true
+            bgp_section = edge_connection.get("bgp_section", {})
+            defaults = data_model.get("defaults", {})
+            default_bgp_pw_enable = (
+                defaults.get("vxlan", {})
+                .get("topology", {})
+                .get("edge_connections", {})
+                .get("bgp_section", {})
+                .get("bgp_password_enable", False)
+            )
+            bgp_password_enable = bgp_section.get("bgp_password_enable", default_bgp_pw_enable)
+            bgp_password = bgp_section.get("bgp_password", "")
+
+            if bgp_password_enable and (not bgp_password or str(bgp_password).strip() == ""):
+                results.append(
+                    f"vxlan.topology.edge_connections.{source_device} "
+                    f"bgp_password_enable is true but bgp_password is not provided. "
+                    f"A non-empty bgp_password is required when bgp_password_enable is true."
+                )
+
         return results
 
     @classmethod