credential/wincred: erase matching creds only