Remove RAW HTML support from Trigger Form UI

[jscheffl]

As follow-up of PR #35460 I propose to remove RAW HTML form support in Airflow 2.10. It was deprecated in 2.8 as of raised security concerns allowing to inject JavaScript into client browser.

You could treat it as "breaking change", following the announced deprecation in 2.8 I would judge it as "anti feature" and therefore can be considered as cleanup / feature release.

[jedcunningham]

I'm generally against this given how we currently handle deprecations - this is a breaking change for those users, and those using it today have already accepted the security risks.

Unless we want to define a policy where we remove deprecated features generally after x time/releases/something, I don't think it's appropriate to remove it from Airflow 2. We have a ton of deprecated features (cough subdags cough) that would meet this "anti feature" bar that we can't remove.

[potiuk]

I'm generally against this given how we currently handle deprecations - this is a breaking change for those users, and those using it today have already accepted the security risks.

Unless we want to define a policy where we remove deprecated features generally after x time/releases/something, I don't think it's appropriate to remove it from Airflow 2. We have a ton of deprecated features (cough subdags cough) that would meet this "anti feature" bar that we can't remove.

Agree. We should remove it in Airlfow 3.

[jscheffl]

Okay, then I'll try to keep this PR in memory until we have an AF3 branch to clean-up

[jscheffl]

As plans for Airflow 3 are around the corner... re-open to have a first cleanup mergeable after new development branch is ready :-D