Fix FAB password hashing to respect FAB_PASSWORD_HASH_METHOD config

[srchilukoori]

Description

FabAirflowSecurityManagerOverride contains three bare generate_password_hash(password) calls in reset_password, add_user, and add_register_user that ignore the FAB_PASSWORD_HASH_METHOD key in the Flask app config. On FIPS-compliant systems, operators set this config to an approved algorithm (e.g. pbkdf2:sha256) but the hardcoded calls bypass it, causing authentication failures.

The fix introduces a _hash_password() helper that reads FAB_PASSWORD_HASH_METHOD from current_app.config (defaulting to scrypt) and replaces all three call sites.

Fixes #65728

Changes

• providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py: Add _hash_password(password) helper; replace 3 bare generate_password_hash(password) calls in reset_password, add_user, and add_register_user.
• providers/fab/tests/unit/fab/auth_manager/test_security.py: Add 4 tests covering helper config-forwarding, scrypt fallback, and both callers.

Root Cause

# Before — method hardcoded to werkzeug default, ignores FAB_PASSWORD_HASH_METHOD
user.password = generate_password_hash(password)

# After — reads FAB_PASSWORD_HASH_METHOD from app config
def _hash_password(self, password: str) -> str:
    method = current_app.config.get("FAB_PASSWORD_HASH_METHOD", "scrypt")
    return generate_password_hash(password, method=method)

user.password = self._hash_password(password)

---

Was generative AI tooling used to co-author this PR?

• Yes Claude

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[vincbeck]

CI is failing

[srchilukoori]

@vincbeck please merge the PR. Thank you.