fix(execution-api): Refresh expired JWT tokens for active tasks #59553

[anishgirianish]

---

Summary

Alternative approach to #59553 - handles expired JWT tokens at the auth layer instead of extending token lifetime.

When a task worker's JWT expires while the task is still running, the worker currently fails with token expiry error. This PR allows expired tokens to be refreshed if the task is in QUEUED or RUNNING state.

Changes

deps.py - JWTBearer auth dependency

• Catch ExpiredSignatureError and attempt token refresh
• Validate signature, claims, and task state before refreshing
• Store refreshed token in request.state for middleware

app.py - JWTReissueMiddleware

• Check request.state.refreshed_token before proactive refresh
• Return refreshed token via Refreshed-API-Token header

tokens.py

• Make get_validation_key public (was _get_validation_key)

test_app.py

• Add tests for expired token refresh (success + rejection)

Security

• Only refreshes for QUEUED/RUNNING tasks (DB check)
• Validates signature before refresh
• Validates all claims same as normal flow

closes #59553
alternative to #60108

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[ashb]

Closing due to #60108 (review) -- this suffers the same problem, and this PR is is no different here.