Allow Variable.get_variable_from_secrets to reuse a caller's session

[seanghaeli]

The helper can't be used under the scheduler's prohibit_commit: MetastoreBackend.get_variable's @provide_session opens the same scoped session and its commit trips the guard, so such callers must duplicate the backend walk.

Fix: optional keyword-only session=None, forwarded only to MetastoreBackend. Then the duplicated loop in serialization/definitions/dag.py can be deleted (see #68917).