[v3-3-test] Hide team scoped values of options registered as sensitive (#70755)

[github-actions]

• Hide team scoped values of options registered as sensitive

Options are registered as sensitive under their base section, but a team scoped
override lives in a [<team>=<section>] config file section, or in an
AIRFLOW__<TEAM>___<SECTION>__<KEY> environment variable. Every sensitivity
decision was a direct membership test against the registered base pairs, and the
masking pass iterated those pairs and looked each section up verbatim, so a team
scoped section was never visited and its value was returned in clear.

Resolve the team scoped spelling back to the base option before deciding whether
a value is sensitive. team_section_name now builds the config file section name
at both construction sites so the two representations cannot drift,
base_section_name recovers the base section from it, and is_sensitive_option
tests a pair directly, then via the base section, then via the tail an
environment variable contributes -- so it can only ever recognise more options as
sensitive, never fewer.

The team name is not parsed out of an environment variable name, because a team
name may contain underscores; the name is matched against the tail each
registered option contributes instead. The config file section name is split on
the last separator, so the base section is recovered even for a team name that
contains the separator itself.

Four call sites use the predicate: the masking pass, the environment collection,
write, and the single option config route, which does not go through as_dict
and so needed its own change.

Team scoped _cmd and _secret entries are hidden in place rather than resolved
into their value, because resolving them is not supported for a team.

Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

• Add newsfragment for the team scoped sensitive option masking change

• Keep one copy of the team scoped masking rationale, and record the untouched gap

The per-key secrets-backend options are matched by literal section name and stay
unaware of a team scoped spelling. Nothing leaks while the secrets backend itself
is not team aware, so it is recorded rather than fixed here.

• Update shared/configuration/tests/configuration/test_parser.py

Co-authored-by: Amogh Desai amoghrajesh1999@gmail.com

• Update airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_config.py

Co-authored-by: Amogh Desai amoghrajesh1999@gmail.com

---

(cherry picked from commit d41ac7b)

Co-authored-by: Jarek Potiuk jarek@potiuk.com
Co-authored-by: Amogh Desai amoghrajesh1999@gmail.com