Make sure grub password regex handles all cases

The regex to match passwords in grub.conf needs to handle both
the --md5 and non-md5 cases and to apply the substitution only
to the secret part (password or password hash).

This needs to deal with the fact that python will return 'None'
for unmatched pattern groups leading to an exception in re.subn()
if not all referenced groups match for a given string (in contrast
to e.g. the perl approach of treating these groups as the empty
string).

Make this explicit by using an empty alternate in the possibly
unmatched '--md5' group:

            r"(password\s*)(--md5\s*|\s*)(.*)",
            r"\1\2********"

Signed-off-by: Bryn M. Reeves <bmr@redhat.com>