fix(security): backport the 1.12 PVR security fixes to 1.11.5 (#14654)

* fix(security): backport the 1.12 PVR security fixes to 1.11.5

Backports the LE-1563 PVR batch. Security-only: where the 1.12 fix is entangled
with a feature, this carries a minimal hand-written equivalent instead and the
feature is documented as 1.12-only.

Ported from the release-1.12.0 PRs:
  LE-2237 #14645  storage-key namespace ownership
  LE-2239 #14643  MCP endpoints require credentials under AUTO_LOGIN
  LE-2240 #14639  export scrubs every secret field, not just API-named ones
  LE-2241 #14635  every cmd.exe execution switch binds to the wrapper allow-list
  LE-2243 #14636  Astra/HCD Data API endpoint routed through the SSRF guard
  LE-2244 #14644  public flows refuse MCP stdio server configuration
  LE-2245 #14646  caller-aware component policy on stored flow graphs
  LE-2247 #14637  Db2 certificate fetch validated and size-bounded
  LE-2248 #14641  MCP stdio env vars denied by runtime family, not exact name
  LE-2249 #14642  code scanner checks values whose binding escapes its scope
  LE-2250 #14640  connector SSRF policy on model-provider base URLs
  LE-2251 #14638  local-file confinement on the S3 storage branch

Hand-written minimal fixes (the 1.12 change carries feature work):
  LE-2242  narrow the deprecated /build/{flow_id}/vertices fetch to owner-only.
           prepare_flow_build_for_user is a no-op under shipped defaults, so the
           fetch predicate is what actually closes the RCE. 1.12 gets this from
           #14497's anonymous-PUBLIC authorization feature, which is not
           appropriate for a patch release.
  LE-2246  add the is_active guard to both API-key lookup branches. The 1.12 fix
           rode in on a SQLite transaction refactor (#14381) that is out of scope.

Deliberately not backported, as 1.12-only:
  the warm-graph registry fast path, CatalogPolicyIdentityUnavailableError
  handling, the MCP env allowlist preflight warning, and the watsonx.data Presto
  temp-certificate cleanup (that component does not exist on 1.11.x).

Two behavioural notes for review:
  * LE-2245's cached-session case fails closed with a 400 rather than rebuilding.
    1.11.x's advanced-run session branch has no rebuild path, so refusing a graph
    that predates the policy is the safe minimal port.
  * The public-flow MCP stdio check is also wired into the
    allow_public_custom_components opt-in branch, which returns before the
    standard validator runs on 1.11.x and would otherwise still spawn.

Versions bumped to 1.11.5 / langflow-base 0.11.5.
Backend suite 3808 passed, 27 skipped; lfx suites 1180 passed.

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix: address review findings on the 1.11.5 PVR backport

Failing CI (Unit Tests - Python 3.14 - Group 3)
  test_chat_endpoint.py monkeypatched
  langflow.api.v1.chat.validate_flow_for_current_settings, which LE-2245
  removed from that module when the stored-graph branch moved to the
  caller-aware prepare_flow_build_for_user. Repoint both patches at the seams
  actually on those paths -- prepare_flow_build_for_user for the
  request-data-vs-stale-DB test, validate_public_flow_no_code_execution for the
  public-access-gate ordering test -- and assert the preflight target, so the
  first test can no longer pass merely because nothing ran.

MCP cmd wrapper: a bare ValueError escaped validate_mcp_stdio_config
  parse_mcp_shell_wrapper signals shell control characters in a cmd payload
  (and unparseable quoting) with a plain ValueError, and it is reached before
  the argument metacharacter scan. `cmd /c "uvx x && calc"` therefore came back
  as ValueError while the equivalent `sh -c` denial came back as
  MCPStdioSecurityError. Fail-closed either way, but the exception type is this
  function's documented contract, so convert it the same way the source-policy
  call above already does.

FileInput: Windows drive-letter paths were treated as storage keys
  _scoped_storage_key tests absoluteness with PurePosixPath only, so
  "C:/data/report.csv" is not absolute, gets split into namespace "C:" plus a
  file name carrying a separator, and is denied -- while "C:\data\report.csv"
  was already exempt for having no "/" at all. Test both flavours so an
  absolute path stays with _enforce_file_paths in either spelling.

Both source fixes land on code that is a byte-identical port of
release-1.12.0, so each needs a companion change there.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>