Eliminate use of `extract()` in `display_setup_form()`. Only needs to read `password` and `password_message`.

See #22400.

Built from https://develop.svn.wordpress.org/trunk@28396


git-svn-id: http://core.svn.wordpress.org/trunk@28224 1a063a9b-81f0-0310-95a4-ce76da25c4cd