I created this PR to add a "manage_db_password" boolean parameter: https://github.com/puppetlabs/puppetlabs-puppetdb/pull/301
My fix has been merged to master in https://github.com/puppetlabs/puppetlabs-puppetdb/pull/301
I suspect that the next release of the puppetdb module will have the new "manage_db_password" and "manage_read_db_password" parameters in it.