Require exactly one filter for latest DAG runs

[skrawcz]

Summary

GET /api/v1/dag_runs/latest/ documents that callers must provide exactly one of project_id or dag_template_id. It currently rejects requests that provide both, but accepts requests that provide neither. With neither filter, the endpoint issues an unfiltered query.

Expected behavior

Require exactly one of project_id or dag_template_id:

• neither provided: return 422
• both provided: return 422
• exactly one provided: return the filtered DAG runs

Changes

• change the endpoint arity check from “at most one” to “exactly one”
• make the permission callback reject requests with no identifier
• add regression tests for neither, both, authorized, and unauthorized filter cases
• clarify the permissive-mode deployment and trust model in the documentation

Credit

Thanks to hackkim (Sunghoon Kim) and Përparim Mjeku for independently identifying and reporting this behavior.