s3-passdb: convert pdb_ipa to use secrets wrappers