Well, username is a part of params and the body itself should be a JSON object, so --form and application/x-www-form-urlencoded won't work here. What you want is this:
curl 'https://localhost:5601/internal/security/login' \
-H 'Accept: */*' \
-H 'Content-Type: application/json' \
-H 'kbn-version: 8.0.0' \
--data-raw '{"providerType":"basic","providerName":"basic","currentURL":"","params":{"username":"***","password":"***"}}'
By the way, the easiest way to get the right request is to just use browser dev tools:
