Change raise_for_status message to hide password in URL

[Overv]

This PR fixes #5021 by replacing a password in the URL with asterisks.

Example:

import requests

r = requests.get("http://foo:[email protected]/status/401")
r.raise_for_status()

Output:

Traceback (most recent call last):
  File "5021.py", line 4, in <module>
    r.raise_for_status()
  File "***/python-requests/requests/requests/models.py", line 968, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: UNAUTHORIZED for url: http://foo:***@httpbin.org/status/401

[Overv]

@jackyzha0 @barroca I'll have time to get back to this next weekend.

[barroca]

@Overv I opened a similar PR for this that might help you to write a test #5244 let me know if you need help.

[Overv]

I've added a unit test.

[mpolena]

Running into this same issue for requests with client_id and client_secret parameters in the url. Those values would get exposed despite the proposed fix here. Seems like a more general solution is needed.