Validate JWT tokens in the ExecutionAPI for strong task identity

[ashb]

This adds in Bearer auth token validation for the entire Execution API server,
and JWT generation to the Scheduler before handing off to the executor.

Some notes about how this is achieved:

• We make heavy use of FastAPI's Dependency Injection to make this work

• We use the svcs module to make managing the service, and viewing the
  state of it, easy

• In .execution_api.routes there are now two routers used -- one which
  ensures that everything underneath it has a valid ExecutionAPI JWT, and
  another one which is "public" (and should contain very few routes)

• We ran into an issue (linked in code) with __future__ annotations imports,
  and had to disable it on one specific file.

• Refreshing of expiring Task Identity tokens is not handled yet (this will
  need middleware to support, a Dependency cannot add the response headers)

• This could almost certainly use more tests than it has right now.

• The API docs know that a JWT Bearer is needed
  

Closes #45107

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

[pierrejeambrun]

Nice I think it's a solid base to keep iterating on, multiple things could be improved but I guess this will be done in follow up PR.

just one remark but not blocking