[Feature Request] Add query-level asset authorization filtering to BaseAuthManager and FastAPI /assets endpoint #72333

Description

Description / Motivation

With AIP-67 (Multi-team) and AIP-56 (Extensible Auth Manager), Airflow 3 empowers multi-tenant platforms by isolating DAGs, Connections, Variables, and Pools per team.
However, the Assets API (/public/assets) currently lacks query-level filtering:

1. AssetDetails only contains id: str | None, omitting uri and name.
2. BaseAuthManager has filter_authorized_dag_ids, filter_authorized_connections, etc., but no filter_authorized_assets or get_authorized_assets.
3. The GET /public/assets endpoint only executes a coarse requires_access_asset(method="GET", details=AssetDetails(id=None)) and executes an unfiltered select(AssetModel).
   In multi-tenant and enterprise compliance environments, exposing all internal asset URIs across tenants in the UI/API can lead to data-catalog leakage and breaks team-level isolation.

Proposed Solution

1. Extend AssetDetails: Add uri: str | None = None and name: str | None = None.
2. Add filter_authorized_assets & get_authorized_assets to BaseAuthManager:
   • Default behavior: Returns all asset IDs (100% backward compatible for single-tenant/default setups).
   • Custom AuthManagers (e.g. team/URI-based) can override it to restrict assets based on URI patterns or team ownership.
3. Add permitted_asset_filter_factory in airflow.api_fastapi.core_api.security:
   • Inject SQL AssetModel.id.in_(permitted_asset_ids) into get_assets.

Backward Compatibility

• Fully backward compatible: Default BaseAuthManager implementation returns all assets, ensuring zero impact on standard deployments.

Use case/motivation

No response

Related issues

No response

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct