Avoid rewriting passwords loaded from keyring

[MelvinCERBA]

Description

pgcli currently writes every non-empty password back to the keyring after a successful connection, including passwords that were just loaded from the keyring.

On macOS, Python keyring updates a credential by deleting and recreating its Keychain item. This resets the item's access controls even when the user previously selected Allow Once.

This change tracks whether the password came from the keyring and avoids writing it back when authentication succeeds. If the stored password is rejected and the user enters a replacement, the new password is still saved. Regression tests cover both paths.

Checklist

• I've added this contribution to the changelog.rst.
• I've added my name to the AUTHORS file (or it's already there).

• I installed pre-commit hooks (pip install pre-commit && pre-commit install).
• I verified that my changes work as expected (this may include manually testing them in your local environment, or in other available environments). Cross this out if not relevant (for example, if you're making a documentation change).
• Please squash merge this pull request (uncheck if you'd like us to merge as multiple commits)