Mask CLI secrets in the audit log by parsed argument, not argv position

[potiuk]

_build_metrics records sys.argv into the audit log (Log.extra) and masked
the variables value by position, assuming the key and value were the final
two arguments.

Any supported trailing option displaces them. airflow variables set KEY VALUE --description TEXT ends in --description TEXT, so the value was written to the
audit log in clear. --description is the instance, not the class — the same is
true of --serialize-json and of any option added later.

The change

• Take the key and value from the parsed Namespace and redact that value
  wherever it appears in the recorded command. Position no longer matters.
• --conn-extra is now masked. It was not handled at all, and it is
  precisely the field connection secrets live in.
• --conn-json and --conn-extra are walked recursively. --conn-json
  masked only top-level keys, so a secret one level down was recorded in clear.
• Both argparse spellings are handled. --conn-json, --conn-extra and
  --conn-uri were matched as standalone tokens only, so the equally valid
  --conn-json=VALUE form skipped redaction entirely. --conn-uri had that gap
  before this change too.
• Long-form password options are masked on every subcommand. --password
  and --conn-password were masked only under users and connections, so
  provider-contributed subcommands that take a password
  (airflow keycloak-auth-manager create-scopes --password ...) recorded it in
  clear. -p stays limited to users and connections, since elsewhere it
  means --port or --exclude-providers.

A value that cannot be parsed as JSON is redacted whole: these options carry
connection material, and a value that cannot be inspected is not safe to record.

For operators

This prevents new disclosures only. Existing Log.extra rows and backups
retain values already written and should be redacted or expired, and any
credentials exposed that way rotated.

Tests

Seven new cases: the value displaced by --description and by --serialize-json,
a non-sensitive key that must still be recorded as given, nested --conn-extra,
nested --conn-json, and the = spelling for --conn-json, --conn-extra and
--conn-uri. All seven fail against unpatched sources; the existing cases are
unchanged and still pass. Three more cover the password options: keycloak-auth-manager --password in both spellings is masked, and api-server -p 8080 is recorded as given.

Not addressed here

airflow dags trigger --conf and airflow backfill create --dag-run-conf also
accept JSON that reaches the audit log unmasked. That is a real and separate
pre-existing exposure with a different blast radius, and folding it in would
widen this change beyond the defect it was scoped to. Worth its own issue.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Code following the guidelines

[potiuk]

@amoghrajesh @kaxil Could you take a look at this when you have a moment? It's targeted at 3.4.0 and needs a review to make the cut on 2026-10-19. CI is green.