Mask nested entities when writing bulk audit-log entries

[potiuk]

The audit-log maskers for Variables and Connections dispatch on top-level key
names -- val/value for variables, extra for connections. A bulk request
body has exactly one top-level key, actions, and the entities sit two levels
down in actions[].entities[], so neither masker ever saw a key it recognised
and the payload was recorded as supplied. The single-entity endpoints mask the
same fields correctly; only the bulk paths diverged.

Approach

_mask_bulk_entities walks actions[].entities[] and applies the existing
per-entity masking to each entry, so the two shapes now agree. The per-entity
logic is unchanged and simply factored out (_mask_connection_entity,
_mask_variable_entity) so both call sites share it.

• A delete action may list bare id/key strings rather than entity objects;
  those carry nothing to mask and are passed through.
• The helper returns None for a non-bulk body so the flat path is untouched.
• It runs on the request body before validation, so malformed shapes
  (actions not a list, missing entities, non-dict actions) must not raise --
  each is covered by a test.

Worth noting for connections: a nested password was already covered, but only
while hide_sensitive_var_conn_fields is enabled, since that is key-name
redaction. extra was never covered by it -- the name is not a recognised
sensitive field and the value is a JSON string, which redact returns
unchanged. Masking extra here is structural and so does not depend on that
setting.

Test plan

• TestMaskBulkFields -- bulk variables, bulk connection extra, multiple
  actions/entities, delete-by-key, and five malformed shapes
• Verified against unmodified code: 5 of the new tests fail, and the
  guard tests correctly pass either way
• test_decorators.py -- 30 passed
• test_variables.py + test_connections.py -- 230 passed
• ruff check / ruff format clean

Was generative AI tooling used to co-author this PR?

• Yes — Claude Opus 5 (1M context)

Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions