Forbid consecutive underscores in team names

[potiuk]

A team scoped secret lives in the _<TEAM>___<SECRET_ID> namespace of the
environment, so that namespace is only unambiguous while no team name can itself
contain the ___ separator.

An earlier revision of this PR got there by forbidding every underscore. That
works, but it is broader than the problem and invalidates ordinary names like
team_a. Forbidding two in a row is the smallest rule that makes the
separator unspellable:

TEAM_NAME_PATTERN = r"(?!.*__)[a-zA-Z0-9_-]{3,50}"

team_a          valid
a-b-c           valid
team__x         invalid
team_a___prod   invalid

With that, the first ___ in the string is always the real separator, so the
guard collapses from "try every split and test each candidate" to one
str.partition.

What that closes

A cross-team read that no amount of guarding the team agnostic fall-through could
reach, because the fall-through is never consulted:

# caller in team "team_a", asking for the BARE id "prod___dbconn"
AIRFLOW_CONN_ + _TEAM_A + ___ + PROD___DBCONN  ->  AIRFLOW_CONN__TEAM_A___PROD___DBCONN

# team "team_a___prod" storing its own "dbconn"
AIRFLOW_CONN_ + _TEAM_A___PROD + ___ + DBCONN  ->  AIRFLOW_CONN__TEAM_A___PROD___DBCONN

Byte-identical, and the team scoped lookup hits — so the caller reads the
other team's secret with no fall-through involved. It is closed here not by
another check but by team_a___prod no longer being a name a team can have.

teams sync now validates stored names too

teams sync shipped with no name validation at all, so a deployment upgrading
into this version can already hold a name this rule rejects. Since the secrets
guard is what keeps one team's namespace out of another's reach, validating only
the incoming bundle config would leave that team's secrets reachable — and would
miss a team created by an earlier sync and since dropped from the config. Both
sets are checked; the command exits non-zero naming the offending names.

One pattern, one matcher

The pattern is defined once in the secrets backend and imported by the CLI, with
a test asserting the two agree so drift fails CI rather than silently reopening
the hole. It is deliberately unanchored and always used with re.fullmatch:
re.match against a $-anchored pattern also accepts a trailing newline, and
unlike teams create the sync path has no .strip().

Behaviour change

• A team name containing __ is rejected by teams create and teams sync.
  Single underscores are unaffected.
• teams sync exits non-zero when any stored or configured team name violates
  the rule, where it previously accepted anything.

Test plan

• test_team_create_rejects_consecutive_underscores — team__x and team_a___prod
• test_team_create_allows_a_single_underscore — team_a still creates
• test_team_sync_rejects_an_invalid_bundle_team_name — too-short, __,
  spans-the-separator, and trailing-newline cases; asserts no team row is created
• test_team_sync_rejects_an_invalid_name_already_stored — a stored ab
  fails the sync
• test_team_name_pattern_is_shared_with_the_secrets_backend
• test_a_valid_team_name_can_never_contain_the_separator — the invariant the
  partition rests on
• test_the_bare_id_collision_is_no_longer_expressible
• 79 passed across test_secrets_environment_variables.py and test_team_command.py
• ruff check / ruff format clean

Was generative AI tooling used to co-author this PR?

• Yes — Claude Opus 5 (1M context)

Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions