fix: replace hardcoded DB password in project template config

[saaa99999999]

Summary

The project template config ships with a hardcoded MySQL root password. Every project created with kratos new inherits these credentials.

What was there

configs/config.yaml — the template checked into the repo:

data:
  database:
    driver: mysql
    source: root:root@tcp(127.0.0.1:3306)/test?parseTime=true&loc=Local

root:root is embedded in the DSN string. New projects start with these credentials unless the developer explicitly overwrites them.

What changed

Replaced with an env var placeholder:

data:
  database:
    driver: mysql
    source: ${DB_DSN:root@tcp(127.0.0.1:3306)/test?parseTime=true&loc=Local}

The host/port/db defaults are preserved but the password is no longer hardcoded in the template.

See also: CWE-798