There are several credential-reference attributes spread in many subsystems that contains an "alternatives" metadata that is mutually exclusive to a "password" field, since the attributes are in different forms, there must be a validator to check this constraint.
The resources that contains this metadata are:
messaging-activemq/jms-bridge
messaging-activemq/server
messaging-activemq/server/bridge
datasources/data-source
datasources/xa-data-source
mail/smtp,pop,imap,custom
resource-adapters/resource-adapter=*/connection-definitions