Session instance `verify` precedence over REQUESTS_CA_BUNDLE

To fix #5209 (more details in the issue)

Results for the [newly-added test](https://github.com/fopina/requests/blob/ca_cert_instance_versus_env/tests/test_requests.py#L1946)

```
➜  git checkout master 
➜  git checkout ca_cert_instance_versus_env -- tests/test_requests.py
➜  pipenv run py.test tests/test_requests.py::TestRequests::test_session_merge_environment_settings_verify
============================================================================================================================= test session starts ==============================================================================================================================
platform linux -- Python 3.7.4, pytest-3.10.1, py-1.8.0, pluggy-0.13.0
rootdir: /home/fopina/Documents/stuff/requests, inifile: pytest.ini
plugins: cov-2.7.1, xdist-1.25.0, httpbin-0.3.0, forked-1.0.2, mock-1.10.4
collected 1 item                                                                                                                                                                                                                                                               

tests/test_requests.py F                                                                                                                                                                                                                                                 [100%]
....
        session.verify = OTHER_PEM
        args[3] = None
        with override_environ(REQUESTS_CA_BUNDLE=SOME_PEM):
>           assert session.merge_environment_settings(*args)['verify'] == OTHER_PEM
E           AssertionError: assert 'x.pem' == 'y.pem'
E             - x.pem
E             ? ^
E             + y.pem
E             ? ^

tests/test_requests.py:1973: AssertionError
=========================================================================================================================== 1 failed in 0.48 seconds ===========================================================================================================================
```
```
➜  git checkout ca_cert_instance_versus_env 
➜  pipenv run py.test tests/test_requests.py::TestRequests::test_session_merge_environment_settings_verify
============================================================================================================================= test session starts ==============================================================================================================================

tests/test_requests.py .                                                                                                                                                                                                                                                 [100%]

=========================================================================================================================== 1 passed in 0.35 seconds ===========================================================================================================================
```

Any reason to not merge this simple fix ?

@Patazerty 

1. Doesn't look like it would merge cleanly
1. Is documented as the behaviour that's unfortunate but not fixable until a major version bump due to a strict backwards compatibility policy


@sigmavirus24 I think that if a PR from 10 months ago would merge cleanly it'd mean the project was quite inactive 😃 I can update it if its to be considered. Or is 1 related to something else?

About 2, I couldn't find it as documented behavior anywhere and it hardly looks like expected behavior for anyone. If verify is not defined for Session, it keeps the same behavior 

I'm also very surprised by this behavior which cost me a couple of hours of debugging until I noticed that when unsetting `REQUESTS_CA_BUNDLE` the issue goes away.

IMO env vars should never have priority over specific code instructions.

> IMO env vars should never have priority over specific code instructions.

Right. It's been acknowledged as a bug, just not one that can be easily fixed in a 2.x release while maintaining the guarantees about minor version upgrades.