Authenticate public Git repositories proactively

[antonio-mello-ai]

Public HTTPS repositories can make their initial Git request anonymously even when the Airflow Git connection supplies a username and access token. That request can therefore consume anonymous rate limits before the server challenges for credentials.

This replaces the manually constructed http.extraHeader approach from #63471 with Git's native, URL-scoped http.<URL>.proactiveAuth=basic configuration:

• enable proactive authentication only for HTTPS connections on Git 2.46 or newer;
• retain the existing challenge-based authentication behavior and emit a warning for older or undetectable Git versions;
• never enable proactive Basic authentication for plaintext HTTP;
• preserve existing GIT_CONFIG_* entries and pass the hook's complete Git environment to bare-repository fetches;
• cover the supported, fallback, composition, and bundle-fetch paths with unit tests and document the version behavior.

This supersedes #63471, which GitHub does not allow the author to reopen after its maintainer closure.

Closes: #54829

Local validation:

• breeze testing providers-tests --test-type "Providers[git]" (132 passed)
• prek run --from-ref upstream/main --stage pre-commit
• prek run --from-ref upstream/main --stage manual
• breeze ci selective-check --commit-ref c60e77d3cd

---

Was generative AI tooling used to co-author this PR?

• Yes — OpenAI Codex (GPT-5.6)

Generated-by: OpenAI Codex (GPT-5.6) following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.