The $foreman::db_password default is a password at the moment, generated in params.pp.  I think we need to change the default to 'UNSET' first, then move the password generator to foreman::database::mysql (again, when it's 'UNSET') as that's the only place it's needed.