Add ReadPassword functionality to ContextReader

[codingllama]

This changes prompt.ContextReader in the following ways:

1. Reads only happen as a response to Read methods being called. This allows ContextReader to coexist with other readers as long as no reads are abandoned.
2. ReadPassword is now available, the underlying implementation being term.ReadPassword.
3. An abandoned password read may be turned into a clean read. This gives us some UX flexibility when callers abandon password reads (looking at you, PromptMFAChallenge).

Turning clean reads into password reads is not supported. It's tricky and I have a few ideas, but it's not paramount at this moment.

This solves the woes caused by abandoned OTP reads followed by PIN reads in different packages, such as client.PromptMFAChallenge followed by tsh mfa add's implementation.

#9160

approved by mistake, meant to comment

[codingllama]

PTAL @zmb3 @espadolini ?

[codingllama]

PTAL?