Session favors environment variable (CURL_CA_BUNDLE) over instance attribute

When setting the `CURL_CA_BUNDLE` environment variable, it overrides the `session.verify` attribute.  It's unclear if this is expected behavior, but I thought it might be worth opening an issue as it caught me off guard.

## Expected Result
```python
import requests
import os


os.environ["CURL_CA_BUNDLE"] = "/tmp/a_cert"

s = requests.Session()
s.verify = "/tmp/another_cert"

# expected to be called with "/tmp/another_cert"
s.get("https://my_route")
```
## Actual Result
```python
# actually gets called with "/tmp/a_cert"
s.get("https://my_route")
```
## Reproduction Steps
Requires using `pdb` to step into 
```python
import requests
import os


os.environ["CURL_CA_BUNDLE"] = "/tmp/a_cert"

s = requests.Session()
s.verify = "/tmp/another_cert"

# gets called with "/tmp/a_cert"
breakpoint()
s.get("https://my_route")
```
If you step into `/requests/sessions.py`
```
515             prep = self.prepare_request(req)
516
517             proxies = proxies or {}
518
519             settings = self.merge_environment_settings(
520                 prep.url, proxies, stream, verify, cert
521             )
522
523             # Send the request.
524             send_kwargs = {
525                 'timeout': timeout,
526                 'allow_redirects': allow_redirects,
527             }
528             send_kwargs.update(settings)
529  ->         resp = self.send(prep, **send_kwargs)
530
531             return resp
(Pdb) send_kwargs
{'timeout': None, 'allow_redirects': True, 'verify': '/tmp/a_cert', 'proxies': OrderedDict(), 'stream': False, 'cert': None}
```
You can see that the request is going to be sent with the certificate from the environment, instead of the one set in the object.
## System Information

    $ python -m requests.help

```json
{
  "chardet": {
    "version": null
  },
  "charset_normalizer": {
    "version": "2.0.12"
  },
  "cryptography": {
    "version": "37.0.2"
  },
  "idna": {
    "version": "3.3"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.8.13"
  },
  "platform": {
    "release": "21.4.0",
    "system": "Darwin"
  },
  "pyOpenSSL": {
    "openssl_version": "30000030",
    "version": "22.0.0"
  },
  "requests": {
    "version": "2.27.1"
  },
  "system_ssl": {
    "version": "101010ff"
  },
  "urllib3": {
    "version": "1.26.9"
  },
  "using_charset_normalizer": true,
  "using_pyopenssl": true
}
```

<!-- This command is only available on Requests v2.16.4 and greater. Otherwise,
please provide some basic information about your system (Python version,
operating system, &c). -->


Hi @hugocarr, thanks for the issue. It appears this is a dupe of #3829 and #2018. This is the current behavior and it's known. We won't be changing it though until the next major release due to it being breaking. I'll resolve this in favor of the originals.

Gotcha, https://github.com/psf/requests/issues/3829 is centred around `REQUESTS_CA_BUNDLE` rather than `CURL_CA_BUNDLE`, which are admittedly a part of the same logic.  Should I add a comment to the original ticket so that the edge case isn't lost?  Or is the dupe against the original sufficient? 

I believe the original is sufficient. If one is fixed the other will implicitly be as well. The issue is more broadly about environment variable resolution vs session resolution.