Separate JWT secret env var from the standard Airflow environment helper

[rohan9446]

AIRFLOW__API_AUTH__JWT_SECRET was rendered from inside the
standard_airflow_environment helper behind an IncludeJwtSecret flag, which
meant every component had to opt out of it explicitly with
(merge (dict "IncludeJwtSecret" false) .).

This moves the variable into its own jwt_secret_environment helper, following
the shape of the existing keda_airflow_environment helper, and includes it
only in the two containers that actually need it — the API server and the
scheduler. Every other caller of standard_airflow_environment passes a plain
context again, and the IncludeJwtSecret context mutation is gone entirely.

What this changes:

• Removes the IncludeJwtSecret plumbing from standard_airflow_environment
  and from all ten call sites.
• Makes secret exposure explicit at the API server and scheduler call sites
  rather than implicit in a shared helper.
• Preserves the least-privilege behaviour introduced in Remove JWT secrets from triggerer, worker and dag-processor #63204: migration/init
  containers, workers, the triggerer and the DAG processor still do not receive
  the raw signing secret.
• Adds regression coverage asserting the secret appears in the API server and
  scheduler containers exactly once, and never in sidecars or init containers.

No behavioural change: the same containers receive the same variable, still
gated on enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET. The only
difference in rendered output is the position of the variable within the env
list, so the ordered assertion in test_have_all_variables is updated to match.

Tested locally with helm v3.21.3: pytest chart/tests/helm_tests/ → 2108 passed.

closes: #70843

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude (Cowork) following the guidelines

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide
Here are some useful points:

• Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
• In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example Dag that shows how users should use it.
• Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
• Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
• Be sure to read the Airflow Coding style.
• Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
  Apache Airflow is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@airflow.apache.org
  Slack: https://s.apache.org/airflow-slack

[SameerMesiah97]

Approved pending green CI.

[boring-cyborg]

Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions.

[Miretpl]

Congrats and welcome to the community!

[github-actions]

Backport failed to create: chart/v1-2x-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
❌	chart/v1-2x-test

You can attempt to backport this manually by running:

cherry_picker 562cc3e chart/v1-2x-test

This should apply the commit to the chart/v1-2x-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.

[Miretpl]

@rohan9446, could you create manual backport of it to chart/v1-2x-test branch?

[rohan9446]

Thanks @Miretpl! Backport is up: #71129

The automated one failed because chart/v1-2x-test still supports Airflow 2 alongside 3, the JWT block there carries an extra semverCompare ">=3.0.0" .Values.airflowVersion gate, there's no keda_airflow_environment helper to anchor the new define against, and the helm tests live under helm-tests/tests/. The version gate now sits inside jwt_secret_environment, so Airflow 2 rendering is unchanged. Full chart suite passes locally (3454 tests).