Well I have been looking at the options for this. But trying to be careful about not leaking the data anywhere. Setting passwords in the environment is not generally a good idea. Git will read a .netrc (or it's own config file in some way) to get user names and passwords. So we could have ansible prompt or get those from config and write those files on the target (and remove after), but that does mean writing clear text passwords to disk.
There is also a memory caching system in git that would avoid any nasty plain password writes to disk but need to find a good way to seed it.
Note that part of the problem is that this happens via wstool, we don't call git direct which limits the options.
Current ssh forward does at least deal with lots of this and doesn't leak.

Partly this can be solved with me setting up the private ansible instance internally (issue has be added). Ansible also has a solution for securely storing passwords.