Ssh – passwordless ssh for another username

You can't.

Whatever you do, your users can bypass it and store their password in a plain text file anyway. If you disable the feature in the client binary, they'll download or compile a different client. As a rule, if you set up obnoxious security measures (such as having to type a password for every svn operation), your users will bypass them in a way that makes security worse. (For example, writing a wrapper script that contains their password. Which they'll leave world-readable.) So don't do that.

To reiterate: you cannot, by technical measures alone, prevent users from storing their password in a file. You can forbid it, but if it makes their life difficult, they'll do it anyway.

If you're concerned about laptop or backup theft, encrypt the users' home directory. This will protect the passwords as well as the data. If the whole home directory is encrypted, the encryption password is usually the same as the login password, for usability reasons. Be sure to have a password backup policy (e.g. a sealed envelope), since losing an encryption password is irrecoverable.

If you're concerned about password reuse, impose a random (hence unique) password, which they will type once and for all into their client. Have a simple process for changing compromised passwords, of course.

Credentials will be saved if you use --username and --password without --non-interactive and --trust-server-cert.

I'm assuming that you are using --non-interactive and --trust-server-cert to avoid the prompt that asks you to accept the certificate. To still avoid this prompt without those parameters, you can have your script create a copy of the file that is generated for each accepted cert in ~/.subversion/auth/svn.ssl.server. This file will be the same for everyone for each respective server. I'm currently using this solution for a script.