GHSA-4FH7-7JX4-8F6C apache-airflow DAG source authorization bypass exposes co-located DAG source

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...