HR security tests should use Vault

Passwords shouldn't be stored in plain text in config files (see e.g. JGRP-1721), Vault should be used instead. So should do also security tests.