Let HookToolset pin arguments the model must not choose

[kaxil]

HookToolset exposes the hook methods in allowed_methods, and until now the model chose every argument of those methods, including the ones that decide what it can reach, such as the bucket a storage hook reads. pinned_arguments fixes those values:

HookToolset(S3Hook(), allowed_methods=["list_keys", "read_key"], pinned_arguments={"bucket_name": "reports"})

A pinned argument is left out of the schema the model sees and passed to every call. If the model supplies it anyway, the call is refused with an error it can read, rather than silently using the model's value. Each call gets its own copy of a pinned value, so a hook method that mutates a list or dict cannot change what the next call receives.

Pinning fails closed. Every method in allowed_methods must name every pinned argument as a parameter it accepts by keyword, or the toolset raises ValueError when it is created. The alternative, skipping methods that don't take a pin, would leave the model free to choose that value on exactly the methods the Dag author didn't check, such as a copy_object whose destination bucket goes by another name.

pinned_arguments is experimental and listed on the stability page.

A scripted model that tries to set the pinned region gets a validation error back, and list_accounts runs with the pinned emea:

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.