Refactor MultiDomainBasicAuth

[jfly]

(This PR is some refactoring that I want to land before creating a PR to implement #12750. If the additional context is useful, you can see my upcoming changes over in jfly/pip@jfly:issue-12750-pre-work-refactor...jfly:pip:issue-12750-configurable-keyring-subprocess-location)

I was starting to work on #12750, but
got hung up on some strange OOP patterns going on here. In particular, I
found it odd that there are 2 different ways we set some knobs
(prompting and keyring_provider) and for instances of
MultiDomainBasicAuth:

1. In tests, we do it by passing these knobs as constructor
   parameters to MultiDomainBasicAuth.
2. In the real cli codepath, we do it by mutating session.auth (an
   instance of MultiDomainBasicAuth) after it's constructed.

I believe that 2) is the reason for the careful cache management logic
you see me tearing out in the PR. Basically: when a
MultiDomainBasicAuth is constructed, it's possible that the keyring
provider will change after the fact, so we can't do any useful caching
in our constructor.

In this PR, I reworked all of this to behave like more normal OOP: I've
tightened up the API of MultiDomainBasicAuth so that these knobs are
only passed in as constructor parameters, and the other instance
attributes are now "private" (underscore-prefixed) values that you're
not supposed to read or write to (except for some tests that look at
these attributes to verify things are working).

This change allowed me to get rid of all the careful cache management
code we had, and sets me up to implement
#12750 as I'm going to be adding yet
another knob (keyring_executable). This new pattern will allow me to
validate that keyring_executable is compatible with keyring_provider
in MultiDomainAuthSettings's constructor (it doesn't make any sense to
specify a path to an executable if you're using the import provider, for
example). With the previous code
pattern, there was just no good place to validate that.

You'll notice I did end up touching a couple of tests:

• test_collector.py: Logging is slightly different now, as we now
  immediately go fetch the keyring provider, rather than lazily. I could
  rework this to preserve the old behavior, but I don't think it's an
  important difference, it only affects tests that are trying to assert
  on every single log message.
• test_network_auth.py: Nothing significant here. Just removing the
  now-unnecessary reset_keyring logic, and updating .password to
  ._password to reflect the new api.

[jfly]

@Darsstar @uranusjr I'd appreciate your thoughts on this PR!

[Darsstar]

LGTM