First of all you are missing double quotes and semicolon at the end
string topost = $"<?xml version='1.0' encoding='UTF-8' standalone='yes' ?><requestservicegateway><userid>{input.USERNAME}</userid><password>{input.PASSWORD}</password>";
Then you go to the http request block, in the “Content” field, switch it to variable mode (click the button next to it until the background turns dark blue) and you type
topost
inside it, which is the name of the variable where the string is stored. It will send that exact string.