Question: If you log in to an sftp server,
Are the username and password sent securely?

Or do you have to have certificate-based authentication to ensure that the entire transmission is encrypted?

If this is client-dependent, then do you know if Tumbleweed and WinSCP can be configured to send username and password securely?

Answer: 
Depends on what you mean by SFTP. For "real" SFTP which stands for SSH File Transfer Protocol authentication is done on SSH layer and it's secure. Some people use "SFTP" as a synonym of FTP-over-TLS, and in this case it depends - in most cases the command channel is encrypted before username and password are sent (this is true only for SSL/TLS-secured connection, not plain FTP!) but it's possible to authenticate in clear text (eg. for debugging purposes).
SFTP goes over SSH, which establishes a secure tunnel by exchanging keys (recall how when you first connect you are prompted to accept and store a key?). Once the secure tunnel is established, all communication through it is encrypted. The username and password are sent via the tunnel, hence they are sent securely.