Mapped XCom slice endpoint accepts a zero step

### Under which category would you file this issue? Airflow Core ### Apache Airflow version `main` ### What happened and how to reproduce it? The Execution API endpoint for reading a mapped XCom sequence slice accepts `step=0` and silently treats it as `step=1`. A zero slice step is invalid sequence semantics, so this hides malformed requests from Task SDK clients. Steps to reproduce: 1. Start the Airflow development environment from the `main` branch. 2. Send the following request through an authenticated Execution API client: ```http GET /execution/xcoms/dag/runid/task/xcom_1/slice?step=0 ``` 3. Observe that the endpoint responds with HTTP 200 instead of rejecting the invalid step: ```json [] ``` The behavior comes from using `params.step or 1`, which converts the valid integer value `0` to the default step of `1`. ### What you think should happen instead? The current Execution API version should reject `step=0` with HTTP 422 before querying XCom data. Older released API versions should retain their existing behavior through the Execution API versioning layer. Omitted, positive, and negative step values should remain unchanged. ### Operating System _No response_ ### Deployment None ### Apache Airflow Provider(s) _No response_ ### Versions of Apache Airflow Providers _No response_ ### Official Helm Chart version Not Applicable ### Kubernetes Version _No response_ ### Helm Chart configuration _No response_ ### Docker Image customizations _No response_ ### Anything else? _No response_ ### Are you willing to submit PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)