feat: add airflow.protectedPipPackages

[thesuperzapper]

What issues does your PR fix?

• related to wait-for-db-migrations Timeout error #605
• probably related to Alembic error when using airflow-migrations #597

What does your PR do?

• Prevents extraPipPackages from changing the version of any pip package listed in airflow.protectedPipPackages.
  • This feature works by adding a pip --constraint file that we generate from the filtered output of pip freeze when installing extraPipPackages.
  • The initial default for airflow.protectedPipPackages is ["apache-airflow"], which will hopefully stop people from accidentally running a different airflow version than specified in their airflow.image.tag.
  • WARNING: if users currently have extraPipPackages configs that are causing their apache-airflow version to be changed, their pods will now crash loop. To resolve this, they will need to remove whatever packages in extraPipPackages were causing the problem.
  • NOTE: users can disable this feature by setting airflow.protectedPipPackages to [], but this is NOT RECOMMENDED as there is probably no situation in which you will want to have extraPipPackages cause an airflow upgrade.

Checklist

For all Pull Requests

• Commits are signed off
• Commits have semantic messages
• Documentation updated
• Passes ct linting

For releasing ONLY

• Chart.yaml version bumped
• CHANGELOG.md updated