Add KeycloakJWTMiddleware to KeycloakAuthManager

[stephen-bracken]

related: #70550 - adds access_token and refresh_token to user correctly

Add KeycloakJWTMiddleware to KeycloakAuthManager

• Add KeycloakJWTMiddleware to the KeycloakAuthManager to extract Keycloak JWT tokens from the request cookies and attach them to the user during auth requests.
• Pass Keycloak JWTs to get_user_from_token() in KeycloakJWTMiddleware, skip refreshing user when called in JWTRefreshMiddleware without the access_token and refresh_token parameters

Rename Keycloak JWT session cookies from access_token and refresh_token to _access_token and _refresh_token for consistency. Since the JWT cookies change is not yet released, this is safe to change.

Note: This change will logout any existing sessions for the KeycloakAuthManager, which should then be handled gracefully by issuing a new Airflow JWT token from the Keycloak login route.

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
• No

---

[vincbeck]

Why do we need a config here?

[stephen-bracken]

I thought I would make the new JWT management an opt-in feature initially, I can take out the config if you don't think its necessary

[vincbeck]

Yeah I think it would be better without config. That creates complexity

[potiuk]

Reviewed the middleware end to end. The refresh flow reads well, the version-compat guard is used consistently in both source and tests, and the thirteen tests cover the cases I would want — refresh, expiry, missing Airflow JWT, missing Keycloak token, and root-cookie clearing.

I also checked the earlier discussion about the config: that has been handled. There is no provider.yaml change, no CONF_*_KEY, and no toggle wording left, so the opt-in has genuinely gone rather than moved somewhere else.

Three things below, one of which I would like resolved before merge.

Separately, and not inline-able: the PR description is still the unedited template. For a change of this size that renames session cookies in an auth manager, the reasoning behind the rename is exactly what a reviewer needs, and this body becomes the squash commit message and the raw material for the changelog. Worth a few lines.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting