T2295: document why update_password needs explicit no_log=False

Ansible PASSWORD_MATCH hides parameters named *password* when no_log is
unset (not the same as defaulting to False). Add comment, changelog
wording, and a unit test; align with ansible.core user module.

Co-authored-by: Cursor <cursoragent@cursor.com>