add autocomplete=off to all password fields

Fixes opscode/chef#1761.

Note that according to [OWASP](https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OWASP-AT-006)#Summary):

> Since early 2014 most major browsers will override any use of autocomplete="off" with regards to password forms and as a result previous checks for this are not required and recommendations should not commonly be given for disabling this feature.

But we'll add it anyway.