Privacy API incorrect for badges

In MDL-69002, Andrew raised the following issue:

Whilst looking to understand what autosync in the DB related to I discovered the following in the privacy API:

// The columns autosync and password are not used.

That is true fo the autosync field but is a not true for the password field.
That field is used every time we connect to the backpack service (when OBv2.0) so the description and the information should be reviewed (because the password field is used and stored). It should be probably backported to 3.8 too.