Question: If you log in to an sftp server,
Are the username and password sent securely?

Or do you have to have certificate-based authentication to ensure that the entire transmission is encrypted?

If this is client-dependent, then do you know if Tumbleweed and WinSCP can be configured to send username and password securely?

Answer: 
Depends on what you mean by SFTP. For "real" SFTP which stands for SSH File Transfer Protocol authentication is done on SSH layer and it's secure. Some people use "SFTP" as a synonym of FTP-over-TLS, and in this case it depends - in most cases the command channel is encrypted before username and password are sent (this is true only for SSL/TLS-secured connection, not plain FTP!) but it's possible to authenticate in clear text (eg. for debugging purposes).
SFTP itself does not authenticate at all. According to its specification it [assumes that it runs over a secure channel](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-13#section-1). As such it expects that underlying channel handles authentication (if any).

So the question is, what channel does your particular instance of SFTP run over. In 99% cases it runs over SSH though (port 22), which sends username and password securely. Note that majority of SFTP clients (WinSCP definitely) and servers do not even support any other channel than SSH.

Strictly speaking even SSH can be configured encryption-less or with inferior encryption. Though again in most cases it is secure. And again, most SSH clients (WinSCP definitely) and servers do not allow encryption-less SSH setup.