PGPASS should be checked after all other methods

Basically I think the precedence should look like this, but we should probably see what the libpq behavior is (where relevant):

1. Password in connection string
2. Passfile in connection string
3. Password callback (not so sure between this and 2 above)
4. Password in environment variable
5. Passfile in environment variable
6. Default passfile

_Originally posted by @roji in https://github.com/npgsql/npgsql/pull/2657#discussion_r335412006_

---

The libpg compatible way of getting the password:

1. Password in connection string
2. Password callback
3. Password in environment variable
4. Passfile in connection string
5. Passfile in environment variable
6. Default passfile

[roji]

I think that the connection string should in general take precedence over programmatic means - this allows users to use the same program/code and select behavior as they want without recompiling or programmatic switching logic.

[YohDeadfall]

#2500 was made because:

1. Npgsql Connection pools are based on the connection string, a new password will create a new pool
2. Npgsql connection pools are never removed once created (but a pool may have zero connections). But if configured to have minimum of 1 problems could arise

It adds some logic into the driver which actually can be done outside of it by excluding the password from the pool key (and maybe other options too).