Add type definition to mci_check_login()'s params

Enforcing string type for $p_password prevents authentication bypass
on MySQL (CVE-2026-30849).

Note that null must be accepted as well, because SOAP API consumers are
allowed to send an XML payload without a password (e.g. for anonymous
login).

For consistency, the type definition is also applied to $p_username.

Fixes 0036902, GHSA-fh48-f69w-7vmp