fix: distinguish authentication from authorization redirects

[aminghadersohi]

Description

This changes FAB's browser-auth behavior so authentication and authorization failures are no longer treated as the same condition:

• an anonymous request denied by @has_access still flashes the existing message and redirects to /login/?next=<requested URL>;
• an authenticated-but-unauthorized request now returns FAB/Flask's HTML 403 response rather than redirecting to login;
• because a login URL therefore represents an authentication requirement, already-authenticated requests to login now honor a safe next URL instead of discarding it. This is applied consistently to DB, LDAP, OAuth, SAML, and Remote User auth views. Missing or unsafe destinations continue to fall back to the application index.

This is intentionally a draft and explicitly invites maintainer discussion: returning 403 instead of 302 for authenticated users is a behavior change, but it avoids redirect loops and aligns MVC behavior with the existing distinction made by @has_access_api.

The fix was split out of Apache Superset PR #43606, following Vitor Avila's suggestion to address the coupled behavior in FAB. It relates to Preset Shortcut story 97504.

The separate backslash redirect-safety issue discussed on the Superset PR is deliberately not included here; it is being handled separately.

Tests cover the 403 response and redirect behavior across every FAB browser auth view, including rejection of an external next destination. The changelog is updated because this affects application-visible behavior.

Testing

python -m pytest -q tests/security/test_auth_views.py tests/security/test_mvc_security.py \
  -k 'authenticated_login_uses_safe_next_url or authenticated_db_login_valid_next_url or authenticated_access_denial_returns_forbidden or sec_login'
14 passed, 30 deselected

python -m flake8 flask_appbuilder/security/decorators.py flask_appbuilder/security/views.py \
  tests/security/test_auth_views.py tests/security/test_mvc_security.py
# passed

git diff --check
# passed

ADDITIONAL INFORMATION

• Has associated issue: Shortcut #97504
• Is CRUD MVC related.
• Is Auth, RBAC security related.
• Changes the security db schema.
• Introduces new feature
• Removes existing feature