Make raw HTML descriptions configurable

[jscheffl]

With AIP-50 we introduced trigger forms and such trigger forms allow to provide raw HTML by DAG authors as descriptions.

During Airflow Summit there were some concerns discussed whether a DAG author would be able to inject dangerous JavaScript into the HTML and how Airflow handles this.

This PR changes the raw HTML support in Airflow in the way:

• A new configuration option allow_html_in_dag_docs is added, which defaults to False
• DAG documentation and Params Descriptions allow raw HTML only based on the server config option
• As alternative for safe but still custom text formatting MD is now supported for parameter descriptions
• Markdown also in DAG description is now filtering HTML tags by default
• The custom_html_form in trigger DAG UI is marked as deprecated for a future / better solution
• Example DAGs have been adjusted from raw HTML to MD descriptions where used.

[potiuk]

LGTM. Few nits only.

[potiuk]

Looks like all checks passed :)

[potiuk]

I think the only thing we need is .significant change description for relese notes.

[jscheffl]

I think the only thing we need is .significant change description for relese notes.

@potiuk how about the one already in? --> https://github.com/apache/airflow/pull/35460/files#diff-1fa4ad17cb7d1ce8e7e5c724a04fceaac361d7cc44f4c27143359083cb4bb700

[potiuk]

I think the only thing we need is .significant change description for relese notes.

@potiuk how about the one already in? --> https://github.com/apache/airflow/pull/35460/files#diff-1fa4ad17cb7d1ce8e7e5c724a04fceaac361d7cc44f4c27143359083cb4bb700

Good enough :)

[jle-pass]

mentioned by CVE-2023-47265
but we don't see it as a CVE in https://github.com/apache/airflow/releases/tag/2.8.0