GHSA-rrxg-g2pf-6hh4: ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

## Summary The dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` dashboard, read the bare `$USERNAME` and `$PASSWORD` instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with `USERNAME` / `PASSWORD` (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port. ## Details Credentials are resolved in `DashboardSettings.parse_args`. …