REST API: Do not include the `password` argument when getting media items

Currently, `attachment` is the only post type exposed via the REST API that
does not support password protection, but it's possible for other post types to
remove password support.

Fixes #38977.

Built from https://develop.svn.wordpress.org/trunk@39595


git-svn-id: https://core.svn.wordpress.org/trunk@39535 1a063a9b-81f0-0310-95a4-ce76da25c4cd