Respect Dag-specific read access in structure endpoint

[Vamsi-klu]

This updates the UI structure endpoint permissions so users with Dag-specific read access can load the serialized topology used by graph and task-group views.

The task group route /dags/{dag_id}/tasks/group/{group_id} uses the UI graph/group context, which calls /ui/structure/structure_data. That response contains serialized Dag topology: task/group nodes, edges, and optional dependency nodes. It does not include task-instance runtime state.

Changes:

• Keep the base requires_access_dag("GET") dependency on /structure/structure_data.
• Require DagAccessEntity.DEPENDENCIES only when external_dependencies=true.
• Do not require DagAccessEntity.TASK_INSTANCE for this topology-only response.
• Add regression tests for Dag-specific read access, unreadable Dags, conditional dependency access, and the intentional absence of task-instance permission.

Validation:

• ruff format airflow-core/src/airflow/api_fastapi/core_api/routes/ui/structure.py airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_structure.py
• ruff check --fix airflow-core/src/airflow/api_fastapi/core_api/routes/ui/structure.py airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_structure.py
• pytest airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_structure.py -q (30 passed)
• prek hooks passed except generate-openapi-spec, which is blocked locally because Breeze tries to use Docker and docker is not installed in this environment.

Manual verification:

• Draft PR pending browser verification on an Airflow dev server. Local process/port checks did not find an Airflow dev server listening on 8080, 28080, 5173, or 8000.

closes: #62532

---

Was generative AI tooling used to co-author this PR?

• Yes - Codex (GPT-5)

Generated-by: Codex (GPT-5) following the guidelines