Consumer team asset filtering: add API endpoint support

[vincbeck]

Add access_control attribute in create asset event API to specify consumer team filtering. Of course, this is optional.

Example:

{
  "asset_id": 0,
  "extra": {},
  "access_control": {
    "consumer_teams": ["teamA", "teamB"],
    "allow_global", False
  }
}

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[potiuk]

Two things before this lands:

Tests (CI red): the 5 failing core tests are all TypeError: option values must be strings — conf_vars({("core", "multi_team"): multi_team}) passes a bool, but conf_vars needs string values. str(multi_team) (or "True"/"False") fixes all five.

API shape: access_control is typed dict[str, Any] and read via .get("consumer_teams") / .get("allow_global"). On a public endpoint that means the nested structure isn't validated and isn't in the generated OpenAPI schema — a typo'd key is silently dropped, and clients have no documented shape (the example in the description has "allow_global", False, which wouldn't even parse). Could we make it a typed submodel, e.g. consumer_teams: list[str] | None = None / allow_global: bool = True? Validation + schema, and it's much harder to change once it's shipped in v2.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting