https://github.com/rails/rails/pull/43280 introduced an enforced `autocomplete="off"` to all hidden inputs generated by Rails to fix a [firefox bug](https://bugzilla.mozilla.org/show_bug.cgi?id=520561).

Unfortunately it's also a legitimate use-case to specify an `autocomplete` with a value such as `username` and a value on a hidden input. This hints to the browser that (in this example) the username of a password reset form is what we've provided as the value and the password manager can store it as such.

This commit only sets `autocomplete="off"` if another `autocomplete` value isn't provided.

Supersedes https://github.com/rails/rails/pull/47798 which didn't seem to be as elegant a solution and didn't have proper tests.