Require exactly one filter for latest DAG runs

## Summary

`GET /api/v1/dag_runs/latest/` documents that callers must provide exactly one of `project_id` or `dag_template_id`. It currently rejects requests that provide both, but accepts requests that provide neither. With neither filter, the endpoint issues an unfiltered query.

## Expected behavior

Require exactly one of `project_id` or `dag_template_id`:

- neither provided: return 422
- both provided: return 422
- exactly one provided: return the filtered DAG runs

## Changes

- change the endpoint arity check from “at most one” to “exactly one”
- make the permission callback reject requests with no identifier
- add regression tests for neither, both, authorized, and unauthorized filter cases
- clarify the permissive-mode deployment and trust model in the documentation

## Credit

Thanks to [hackkim](https://github.com/hackkim) (Sunghoon Kim) and Përparim Mjeku for independently identifying and reporting this behavior.

Start at the GET /api/v1/dag_runs/latest/ endpoint and inspect its current arity check and permission callback. Add regression coverage for neither, both, authorized, and unauthorized filter cases, then clarify the permissive-mode deployment and trust model in the documentation. Done means only exactly one identifier is accepted and invalid requests return 422.

Written by the indexing model from the issue text.