Fix credential exposure in keygen() tracebacks

[bubblegum-h]

Summary

Prevent API passwords from being exposed in exception tracebacks when keygen() fails.

Problem

The keygen method builds a query dict containing the password ({'type': 'keygen', 'user': '...', 'password': '...'}). On PanXapiError, the traceback can include this local variable, exposing credentials in logs and error reports.

Solution

Clear the password from the query dict in a try/finally block so it is removed before any exception propagates. By the time the traceback is captured, the password is no longer in the query dict.

Impact

• No change to API behavior; the password is only removed after the request is sent.
• query is used only by __api_request; no other references are affected.

[bubblegum-h]

@kevinsteves, I tried reach you via email. I haven't gotten back from you. Please have a look at this PR. Thanks