How can I tell Drupal to add autocomplete=off to the login form
It seems there is a module for this, No Autocomplete.
As a sidenote (copied from the module's page:


  However, browsers and password managers and the like may very well not
  respect the "autocomplete=off" attribute anyway. For example, Chrome
  seems no longer to respect it and Lastpass ignores it by default.


Well, good luck with Qualys!