[AIRFLOW-6349] - secure api and cookie by default

[tooptoop4]

AIRFLOW-6349

Make sure you have checked all steps below.

Jira

• My PR addresses the following AIRFLOW-6349 issues and references them in the PR title. For example, "[AIRFLOW-6349] My Airflow PR"
  • https://issues.apache.org/jira/browse/AIRFLOW-6349
  • In case you are fixing a typo in the documentation you can prepend your commit with [AIRFLOW-6349], code changes always need a Jira issue.
  • In case you are proposing a fundamental code change, you need to create an Airflow Improvement Proposal (AIP).
  • In case you are adding a dependency, check if the license complies with the ASF 3rd Party License Policy.

Description

• Here are some details about my PR, including screenshots of any UI changes:

Tests

• My PR adds the following unit tests OR does not need testing for this extremely good reason:

Commits

• My commits all reference Jira issues in their subject lines, and I have squashed multiple commits if they address the same issue. In addition, my commits follow the guidelines from "How to write a good git commit message":
  1. Subject is separated from body by a blank line
  2. Subject is limited to 50 characters (not including Jira issue reference)
  3. Subject does not end with a period
  4. Subject uses the imperative mood ("add", not "adding")
  5. Body wraps at 72 characters
  6. Body explains "what" and "why", not "how"

Documentation

• In case of new functionality, my PR adds documentation that describes how to use it.
  • All the public functions and the classes in the PR contain docstrings that explain what it does
  • If you implement backwards incompatible changes, please leave a note in the Updating.md so we can assign it to a appropriate release

[mik-laj]

Can you add note in UPDATING.MD? Some may install AIRFLOW automatically and may be surprised that the default value has changed. I also think that he should change the name of package `airflow.api.auth.backend.deny_all to a different one to better describe the content.
I also noticed that another person(me) is already working on it.
https://github.com/apache/airflow/pull/6625/files

[tooptoop4]

closing as dupe of https://github.com/apache/airflow/pull/6625/files