Mask nested entities when writing bulk audit-log entries

[potiuk]

The audit-log maskers for Variables and Connections dispatch on top-level key
names -- val/value for variables, extra for connections. A bulk request
body has exactly one top-level key, actions, and the entities sit two levels
down in actions[].entities[], so neither masker ever saw a key it recognised
and the payload was recorded as supplied. The single-entity endpoints mask the
same fields correctly; only the bulk paths diverged.

Approach

_mask_bulk_entities walks actions[].entities[] and applies the existing
per-entity masking to each entry, so the two shapes now agree. The per-entity
logic is unchanged and simply factored out (_mask_connection_entity,
_mask_variable_entity) so both call sites share it.

• A delete action may list bare id/key strings rather than entity objects;
  those carry nothing to mask and are passed through.
• The helper returns None for a non-bulk body so the flat path is untouched.
• It runs on the request body before validation, so malformed shapes
  (actions not a list, missing entities, non-dict actions) must not raise --
  each is covered by a test.

Worth noting for connections: a nested password was already covered, but only
while hide_sensitive_var_conn_fields is enabled, since that is key-name
redaction. extra was never covered by it -- the name is not a recognised
sensitive field and the value is a JSON string, which redact returns
unchanged. Masking extra here is structural and so does not depend on that
setting.

Test plan

• TestMaskBulkFields -- bulk variables, bulk connection extra, multiple
  actions/entities, delete-by-key, and five malformed shapes
• Verified against unmodified code: 5 of the new tests fail, and the
  guard tests correctly pass either way
• test_decorators.py -- 30 passed
• test_variables.py + test_connections.py -- 230 passed
• ruff check / ruff format clean

Was generative AI tooling used to co-author this PR?

• Yes — Claude Opus 5 (1M context)

Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

[amoghrajesh]

One future enhancement, otherwise LGTM.

[github-actions]

Backport failed to create: v3-3-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
❌	v3-3-test

You can attempt to backport this manually by running:

cherry_picker fc8d6d8 v3-3-test

This should apply the commit to the v3-3-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.