<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
We deploy to both Linux and Windows servers.  For Linux servers, we use ssh with key pairs, then sudo to become the target user.  For Windows servers, we use winrm/ntlm with a common ID and have to supply a password.  The password needs to be set in a vault.  The ansible_password variable cannot be set globally because it breaks the ssh key/pair logins.  Our solution was to create a variable that goes in the vault named WIN_PASS.  The gather_facts stage fails on the Windows servers the ansible_password isn't set.  So we start our playbook by setting ansible_password for those servers using set_fact and gather_facts: no.  This works without warning.  However, when we proceed to the next play, we get a warning at the play level: **[WARNING]: Removed restricted key from module data: ansible_password = ...**. The variable still contains the password and the tasks successfully authenticate with the windows host.  The only issue is that the warning exposes the password.  I have seen this issue reported and duplicated several times (for example: set_fact ansible_ssh_common_args fails #37535), but all are now closed.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
task_executor.py
##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below

ansible 2.7.10
  config file = /<custompath>/ansible.cfg
  configured module search path = [u'/<custompath>/ansible_core/ansible/modules', u'/<custompath>/ansible/ansible_cust/modules']
  ansible python module location = /<custompath>/ansible_core/ansible
  executable location = /<custompath>/ansible_core/bin/ansible
  python version = 2.7.15 (default, May  3 2019, 15:19:10) [GCC 4.4.7 20120313 (Red Hat 4.4.7-23)]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
[plays]$ ansible-config dump --only-changed
CACHE_PLUGIN(/<custompath>/ansible/ansible.cfg) = memory
DEFAULT_ACTION_PLUGIN_PATH(/<custompath>/ansible/ansible.cfg) = [u'/<custompath>/ansible/ansibl
DEFAULT_CALLBACK_PLUGIN_PATH(/<custompath>/ansible/ansible.cfg) = [u'/<custompath>/ansible/ansi
DEFAULT_CALLBACK_WHITELIST(/<custompath>/ansible/ansible.cfg) = [u'q_callback:service_callback']
DEFAULT_FACT_PATH(/<custompath>/ansible/ansible.cfg) = /<custompath>/facts
DEFAULT_FORKS(/<custompath>/ansible/ansible.cfg) = 50
DEFAULT_GATHER_TIMEOUT(/<custompath>/ansible/ansible.cfg) = 20
DEFAULT_HASH_BEHAVIOUR(/<custompath>/ansible/ansible.cfg) = merge
DEFAULT_INVENTORY_PLUGIN_PATH(/<custompath>/ansible/ansible.cfg) = [u'/<custompath>/ansible/ans
DEFAULT_MODULE_PATH(/<custompath>/ansible/ansible.cfg) = [u'/<custompath>/ansible_core/ansible/
DEFAULT_MODULE_UTILS_PATH(/<custompath>/ansible/ansible.cfg) = [u'/<custompath>/ansible/ansible
DEFAULT_ROLES_PATH(/<custompath>/ansible/ansible.cfg) = [u'/<custompath>/ansible/roles', u'/opt
HOST_KEY_CHECKING(/<custompath>/ansible/ansible.cfg) = False
INVENTORY_ENABLED(/<custompath>/ansible/ansible.cfg) = [u'test_inv', u'host_list', u'script', u'yam
(END) 

```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
RHEL 6.10 and Windows 10

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->

<!--- Paste example playbooks or commands between quotes below -->
```yaml
---
- name:  Prime Windows Facts
  hosts: conv
  gather_facts: no
  roles:
  - <role>
  tasks:
  - set_fact:
      ansible_password: "{{ WIN_PASS }}"
      cacheable: yes

- name: Debug something
  hosts: conv,dmgr
  tasks:
  - debug:
      msg: "{{ ansible_system }}"

```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
We don't see the password

##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes -->
```paste below
PLAY [Prime Windows Facts] ****************************************************************************

TASK [<role>: Including Passwords] *********************************************************
ok: [<host>] => {
    "msg": "Including Passwords for <env>"
}

TASK [<role> : include Environment Passwords] ***********************************************
ok: [<host>]

TASK [<role> : fact cache windows password] *************************************************
ok: [<host>]

TASK [set_fact] ***************************************************************************************
ok: [<host>]

PLAY [Debug something] ********************************************************************************
 [WARNING]: Removed restricted key from module data: ansible_password = REDACTED


TASK [Gathering Facts] ********************************************************************************
ok: [<host>]
ok: [<host>
TASK [debug] ******************************************************************************************
ok: [<host>] => {
    "msg": "Win32NT"
}
ok: [<host>] => {
    "msg": "Linux"
}

```
'''
    More nuanced version of strip_internal_keys
    '''
    for key in list(data.keys()):
        if (key.startswith('_ansible_') and key != '_ansible_parsed') or key in C.INTERNAL_RESULT_KEYS:
            display.warning("Removed unexpected internal key in module return: %s = %s" % (key, data[key]))
            del data[key]
    
    for key in ['warnings', 'deprecations']:
        if key in data and not data[key]:
            del data[key]
    
    for key in list(data.get('ansible_facts', {}).keys()):
        if key.startswith('discovered_interpreter_') or key.startswith('ansible_discovered_interpreter_'):
            del data['ansible_facts'][key]
def clean_facts(facts):