cli: manage sends an empty password when EXTENDDB_PASSWORD is empty #917

When EXTENDDB_PASSWORD is set to an empty value and --password is absent, extenddb manage sends the request with an empty password. It does not answer No password provided. resolve_password returns any value of the variable (crates/app/src/manage_http.rs:74 on main at 35edb77). #849 moves that choice to choose_password in crates/app/src/cmd_manage.rs and keeps the behavior.

An empty password counts as a failed login. The rate limiter refuses a principal after 5 failed attempts from one address in 15 minutes (crates/server/src/rate_limit.rs). So a script whose variable expands to nothing can lock that principal out from the script's address after five runs.

Suggested change: treat an empty value as unset, and add a test for it.

Raised in the review of #849.