As fallout from #4074 and #3090 I wanted a basic_auth_password_file option on an http client. This helps to keep the HTTP basic auth password out of display and logs.

I went ahead and filed prometheus/common#129, but noticed in testing that prometheus uses a slightly modified version.