Mask list-shaped Variable values on deserialization

[potiuk]

_mask_and_deserialize_variable dispatched on the top-level type of the
deserialized value and handled only str and dict. A Variable whose JSON is a
list therefore matched no branch and was returned with nothing inside it masked.

add_mask walks dicts and iterables itself, so the same list nested one level
inside a dict was already masked -- the top-level dispatch was the only thing
deciding whether the nested values were reached at all.

Approach

Add the list branch, passing the value under the variable's key rather
than anonymously.

That distinction is the whole design of the change. Elements of a list have no
key names of their own, so they follow the variable key's sensitivity -- the same
rule already applied to a plain string value. Passing the list anonymously would
mask every element unconditionally and add each to the global pattern set, so a
Variable holding ["us-east-1", "eu-west-1"] would cause us-east-1 to be
redacted everywhere it appeared in any log. test_var_json_list_value_does_not_over_mask
already guarded that, and this keeps it true. Dicts inside the list are still
masked by their own key names.

Verified against the real masker:

variable	key	result
[{"password": "…"}]	db_configs	[{"password": "***"}]
["us-east-1", "eu-west-1"]	aws_regions	unchanged
["…"]	my_password	***
{"password": "…"}	db_config	{"password": "***"} (unchanged path)

test_var_json_list_value_does_not_over_mask is updated: it asserted
mask_secret was called exactly once, and there are now two calls. The property
it guards is unchanged and the assertion is now stated directly -- the list is
passed under the variable's key, and never anonymously.

Test plan

• test_var_json_masks_list_values -- list handed to the masker under the
  variable's key
• test_var_json_list_value_does_not_over_mask -- updated to assert the
  no-over-masking property rather than the call count
• test_var_json_scalar_values_pass_through -- int/bool/null/float returned
  unchanged
• Verified against unmodified code: both list tests fail
• test_context.py -- 170 passed
• ruff check / ruff format clean

Was generative AI tooling used to co-author this PR?

• Yes — Claude Opus 5 (1M context)

Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

[SameerMesiah97]

Looks good. Just a few stylistic nits (for e.g. I found one comment a bit hard to understand).

[potiuk]

All threads addressed and resolved. Comments trimmed as suggested.

I did not take the branch collapse — the equivalence relies on add_mask ignoring the name it is handed for a dict, so the key would be passed and silently ignored, and the dict branch is pre-existing behaviour I would rather not rewrite inside a 3.3.1 backport. Reasoning is in that thread if you disagree.

@amoghrajesh @SameerMesiah97

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting

[amoghrajesh]

Thanks, simple enough now.

[github-actions]

Backport successfully created: v3-3-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-3-test