Mention "password-command" as a config file option

[dwijnand]

• Patches conform to the coding conventions.
• Any changes that could be relevant to users have been recorded in the changelog.
• The documentation has been updated, if necessary.
• If the change is docs-only, [ci skip] is used to avoid triggering the build bots.

Fixes #5224

I tested this by building cabal-install and looking at the output of upload --help. On it's own, I'm not sure if that's worth wiring up a test for. Perhaps the output of upload --help as a whole could be tested? WDYT?

[hvr]

@dwijnand tbh, I think it's overkill to add a test for such a trival UI aspect; however, a brief mention in cabal-install's changelog pointing to #5224 would be desirable