Potential fix for code scanning alert no. 1: Clear-text logging of sensitive information

[Yaketh (Kushmanmb)]

Potential fix for https://github.com/kushmanmb-org/bitcoin/security/code-scanning/1

In general, to fix clear-text logging of sensitive information, remove or redact sensitive fields before logging or printing, and only output the minimum non-sensitive data required for functionality. If a secret must be shown (e.g., to a human once), constrain it to explicit, documented, non-logged channels.

For this script, the best minimal fix is to stop including the plaintext password in the JSON output. The JSON output is presumably meant for automated consumption (e.g., tooling that wants username and rpcauth), and the rpcauth string already contains the necessary information without exposing the raw password. We will therefore modify the if args.json: branch so that odict contains only non-sensitive fields: keep username and rpcauth, and drop the password field. The non-JSON branch can remain unchanged, since it is an interactive display where showing the password is expected behavior; if a stricter policy is desired, it could later be adjusted similarly.

Concretely, in share/rpcauth/rpcauth.py, around line 40, we will change the construction of odict to exclude password. No new imports or helper methods are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.