just query whatever subscriber back-end you have, fetch the password (decrypt according to your architecture requirements) and supply it to this method through AVP. I recommend never to use plain text passwords, even in this scenario (you should make ha1 hash before encrypting it specific to your back-end requirements, so that when kamailio script decrypts it at run time, it would get ha1 hash, rather then plaintext, thus keep it somewhat safe even against memory exploits from remote hackers).
Regarding the digest response hash sent by client, no it is not possible to decrypt it (at least under normal circumstance). You may find ways to modify the response hash, but it would be most likely pointless (since you do not know what was actually entered by the user as password).