Python: sanitize known-safe Airflow log projections

[yoff]

Alert-quality correction

This layer adds exact, Airflow-scoped known-safe projections for cleartext-logging analysis. Intentional full-Airflow selects decrease from 130 to 56. All nine established false-positive locations are removed, and 26 additional common false paths were reviewed. Dictionary value v and focused positive controls remain retained.

Provenance and performance effects

Measured provenance changes are edges 285,075 -> 384, nodes 99,903 -> 317, subpaths 145,979 -> 14, and BQRS 21,673,846 -> 36,736. This is deterministic work reduction. This PR makes no DCA claim and does not launch DCA.

Provenance

• Exact base ref: yoff-freecad-guarded-use-hotspot
• Exact base SHA: 80939b08790e0de870e8a5014b95f4fdfe5ae961
• Exact head SHA: d3ad4d4832df8ef7c7ee2cab44387459ea687bec

Tests

Passed:

codeql test run --search-path /Users/yoff/.local/share/gh/extensions/gh-codeql/dist/release/v2.26.3 --additional-packs python/ql/lib:python/ql/src:python/ql/test python/ql/test/query-tests/Security/CWE-312-CleartextLoggingAirflow python/ql/test/query-tests/Security/CWE-312-CleartextLogging python/ql/test/library-tests/dataflow/sensitive-data

All 3 tests passed.