deny unknown backfill_id directly instead of falling back to body dag_id

[bujjibabukatta]

Summary

Fixes an authorization bug in requires_access_backfill where an unknown backfill_id could be distinguished from a forbidden one by response status code, leaking which backfill ids exist.

Root Cause

When backfill_id was present but matched no row, dag_id stayed None — the same as when there was no backfill_id at all — so the check fell through to authorizing against a dag_id from the request body instead of denying outright.

Fix

If backfill_id is given but matches no row, deny immediately with 403 Forbidden (the same response a forbidden-but-existing backfill gets), instead of falling back to the body-supplied dag_id.

Closes: #71080

Was generative AI tooling used ?

• Yes - Claude

Generated-by: Claude following the guidelines