JENKINS-61812 Fix read only password (#4622)

* JENKINS-61812 Fix read only password

* Don't call getPasswordValue until later

core/src/main/resources/lib/form/password.jelly

@@ -60,20 +60,22 @@ THE SOFTWARE.
       If any other value is specified then requests will use GET.
     </st:attribute>
   </st:documentation>
+  <f:prepareDatabinding/>
+  <j:set var="resolvedValue" value="${attrs.value ?: instance[attrs.field]}" />
+
   <j:choose>
     <j:when test="${readOnlyMode}">
       <j:choose>
-        <j:when test="${value}"><span class="jenkins-readonly">****</span></j:when>
+        <j:when test="${!empty(resolvedValue)}"><span class="jenkins-readonly">****</span></j:when>
         <j:otherwise>
           <span class="jenkins-not-applicable">N/A</span>
         </j:otherwise>
       </j:choose>
     </j:when>
     <j:otherwise>
-      <f:prepareDatabinding/>
       <j:choose>
         <j:when test="${h.useHidingPasswordFields()}">
-          <j:set var="value" value="${h.getPasswordValue(attrs.value ?: instance[attrs.field])}"/>
+        <j:set var="value" value="${h.getPasswordValue(resolvedValue)}"/>
           <j:choose>
             <j:when test="${ value != null }">
               <st:adjunct includes="lib.form.password.password"/>
@@ -134,7 +136,7 @@ THE SOFTWARE.
           <m:input xmlns:m="jelly:hudson.util.jelly.MorphTagLibrary"
                    class="setting-input ${attrs.checkUrl!=null?'validated ':''}${attrs.clazz}"
                    name="${attrs.name ?: '_.'+attrs.field}"
-                   value="${h.getPasswordValue(attrs.value ?: instance[attrs.field])}"
+                   value="${h.getPasswordValue(resolvedValue)}"
                    type="password"
                    checkMethod="post"
                    ATTRIBUTES="${attrs}" EXCEPT="field clazz value"/>