Strip credentials from ambiguous source warnings.

Fixes #3249.
This ended up getting a little tricky...

1. Because there may be multiple Rubygems source instances, they should share the cache.
2. Because this code is called during installation, which may be happening concurrently in multiple threads, the cache needs to be thread safe.

I'm _pretty sure_ this implementation should be safe for parallel installation, but if you're still planning on pairing with @headius on thread-safety stuff during RubyConf, this might be something to look at more closely.