Bump flask-appbuilder to 5.2.2 in FAB provider (#69730)

Flask-AppBuilder 5.2.2 ships security-manager hardening — LDAP
search-filter escaping, OAuth email-whitelist regex anchoring, and
API-login provider validation. Airflow's vendored security manager
already escapes LDAP filters (and validates the search filter), and it
inherits the OAuth whitelist matching from FAB's OAuth view via super(),
so these fixes land without any change to the vendored override; the FAB
alignment test confirms the vendored code stays structurally in sync
with the new release.

Author: potiuk

providers/fab/README.rst

@@ -57,7 +57,7 @@ PIP package                                 Version required
 ``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``blinker``                                 ``>=1.6.2``
 ``flask``                                   ``>=2.2.1``
-``flask-appbuilder``                        ``==5.2.1``
+``flask-appbuilder``                        ``==5.2.2``
 ``pyjwt``                                   ``>=2.11.0``
 ``flask-login``                             ``>=0.6.2; python_version < "3.14"``
 ``flask-login``                             ``>=0.6.3; python_version >= "3.14"``

providers/fab/docs/index.rst

@@ -111,7 +111,7 @@ PIP package                                 Version required
 ``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``blinker``                                 ``>=1.6.2``
 ``flask``                                   ``>=2.2.1``
-``flask-appbuilder``                        ``==5.2.1``
+``flask-appbuilder``                        ``==5.2.2``
 ``pyjwt``                                   ``>=2.11.0``
 ``flask-login``                             ``>=0.6.2; python_version < "3.14"``
 ``flask-login``                             ``>=0.6.3; python_version >= "3.14"``

providers/fab/pyproject.toml

@@ -77,7 +77,7 @@ dependencies = [
     # Every time we update FAB version here, please make sure that you review the classes and models in
     # `airflow/providers/fab/auth_manager/security_manager/override.py` with their upstream counterparts.
     # In particular, make sure any breaking changes, for example any new methods, are accounted for.
-    "flask-appbuilder==5.2.1",  # Whenever updating the version, run test_fab_alignment.py to verify.
+    "flask-appbuilder==5.2.2",  # Whenever updating the version, run test_fab_alignment.py to verify.
     # Transitive via flask-appbuilder -> flask-jwt-extended; pinned here so the FAB
     # provider keeps installing cleanly when paired with older airflow-core releases
     # (the compat-3.0.6 matrix job) whose own pyjwt floor predates `jwt.types.Options`

providers/fab/tests/unit/fab/auth_manager/security_manager/test_fab_alignment.py

@@ -40,7 +40,7 @@
 from airflow.providers.fab.auth_manager.security_manager.override import FabAirflowSecurityManagerOverride
 
 # The FAB version that override.py was last aligned with.
-EXPECTED_FAB_VERSION = "5.2.1"
+EXPECTED_FAB_VERSION = "5.2.2"
 
 # FAB public methods that override.py intentionally does NOT implement.
 # Every entry must have a comment explaining why it's excluded.