Bump starlette to 1.3.1 for bounded form parsing - #73302

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

What

Fix for CI https://github.com/apache/airflow/actions/runs/35265542917

test_login.py::TestCreateTokenUnparsableBody::test_form_parser_error_keeps_its_own_detail
assert 422 == 400

airflow-core declared starlette>=1.0.1, so lowest-direct resolution installed 1.0.1, a version whose application/x-www-form-urlencoded parser enforces no limits at all.

Current behaviour

In Starlette 1.0.1, only the multipart parser enforces max_fields. The urlencoded FormParser has no field-count or field-size bound, and Request._get_form does not wrap it in the MultiPartException to HTTPException(400) translation that the multipart branch gets.

parse_login_body relies on that translation: it only converts ClientDisconnect, and deliberately lets Starlette's own 400 ("Too many fields...") propagate rather than flattening it into the generic message. Below Starlette 1.3.1 that reliance does not hold: a 2000-field body parses cleanly, username and password come back None, and LoginBody validation answers 422.

Beyond the test, this means the declared floor claimed support for a configuration in which the unauthenticated POST /auth/token route parses a urlencoded body with no field-count or field-size bound.

Changes of Note

1.3.1 is the exact boundary, established by bisecting the published wheels:

Starlette's 1.3.1 notes: "Enforce max_fields and max_part_size in FormParser" and "Enforce FormParser limits in parser callbacks".

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.