Mapped XCom slice endpoint accepts a zero step

### Under which category would you file this issue?

Airflow Core

### Apache Airflow version

`main`

### What happened and how to reproduce it?

The Execution API endpoint for reading a mapped XCom sequence slice accepts `step=0` and silently treats it as `step=1`. A zero slice step is invalid sequence semantics, so this hides malformed requests from Task SDK clients.

Steps to reproduce:

1. Start the Airflow development environment from the `main` branch.
2. Send the following request through an authenticated Execution API client:

```http
GET /execution/xcoms/dag/runid/task/xcom_1/slice?step=0
```

3. Observe that the endpoint responds with HTTP 200 instead of rejecting the invalid step:

```json
[]
```

The behavior comes from using `params.step or 1`, which converts the valid integer value `0` to the default step of `1`.

### What you think should happen instead?

The current Execution API version should reject `step=0` with HTTP 422 before querying XCom data. Older
released API versions should retain their existing behavior through the Execution API versioning layer.
Omitted, positive, and negative step values should remain unchanged.

### Operating System

_No response_

### Deployment

None

### Apache Airflow Provider(s)

_No response_

### Versions of Apache Airflow Providers

_No response_

### Official Helm Chart version

Not Applicable

### Kubernetes Version

_No response_

### Helm Chart configuration

_No response_

### Docker Image customizations

_No response_

### Anything else?

_No response_

### Are you willing to submit PR?

- [x] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Start with the Execution API endpoint for mapped XCom slice requests and trace its versioning layer. Reproduce the provided authenticated request, then verify that the current API rejects step=0 with HTTP 422 while omitted, positive, and negative steps remain unchanged and older released API versions retain their behavior.

Written by the indexing model from the issue text.