Remove dag_id/run_id/task_id from XCom URL in favor of JWT token

### Description

Currently, the `/execution/xcoms/{dag_id}/{run_id}/{task_id}/{key}` endpoint in the Execution API accepts the DAG ID, Run ID, and Task ID as URL parameters.

However, since the Task SDK now authenticates with the Execution API using a short-lived JWT token that is inherently scoped to the specific task instance, passing these identifiers in the URL is redundant and bypasses the zero-trust model.

An existing `TODO` in `xcoms.py` notes that we should remove these parameters from the URL and rely entirely on the information embedded in the JWT token (or looked up via the token ID).

### Use case/motivation

- **Security**: Enforces that the worker can only set XComs for the exact task instance it is authorized for (zero-trust model).
- **Simplicity**: Cleans up the URL structure and routing logic.
- **Payload/Path Reduction**: Removes redundant path variables that the worker shouldn't have to explicitly specify anyway.

### Related issues

_No response_

### Are you willing to submit a PR?

- [x] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Start in xcoms.py at the existing TODO and the Execution API endpoint for XComs. Trace how the short-lived JWT identifies the task instance and how the current dag_id, run_id, and task_id URL parameters are used. Done means the endpoint no longer requires those identifiers in its URL and authorization relies on the token-scoped task instance.

Written by the indexing model from the issue text.