Add Security Audit Logging for Authentication and Authorization Events

## Current Situation
Currently, Airflow has comprehensive logging for DAG-related events (like DAG pausing, running, etc.) through the `Log` model. However, I notice that there seems to be a lack of detailed audit logging for security-related events, specifically:

1. Authentication events:
- Login attempts (successful/failed)
- Password changes
- Session management
- API token usage

2. Authorization events:
- Permission checks
- Access denials
- Role changes
- Permission grants/revokes

## Questions
1. Is my understanding correct about the current state of security audit logging in Airflow?
2. Are there any plans to implement comprehensive security audit logging?
3. If yes, is there already a design proposal or timeline for this feature?

## Potential Solution
We could extend the current `Log` model or create a new `SecurityAuditLog` model to capture these events. Example structure:
```python
class SecurityAuditLog(Base):
__tablename__ = 'security_audit_log'

id = Column(Integer, primary_key=True)
timestamp = Column(DateTime, default=datetime.utcnow)
event_type = Column(String) # LOGIN, PERMISSION_CHECK, etc.
user = Column(String)
status = Column(String) # SUCCESS, FAILURE
details = Column(JSON)
ip_address = Column(String)
user_agent = Column(String)
```

### Use case/motivation

Having security audit logs would be valuable for:
- Security compliance requirements
- Security incident investigations
- User access pattern analysis
- Troubleshooting authentication issues
- Detecting potential security breaches

### Related issues

_No response_

### Are you willing to submit a PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Start by reviewing Airflow's existing Log model and current authentication and authorization event handling. Compare the proposed SecurityAuditLog fields with the events listed in the issue, then look for an existing design proposal or implementation plan. Done would require an agreed scope and design for comprehensive security audit logging, rather than only a single obvious edit.

Written by the indexing model from the issue text.