fix: verify=False precedence over REQUESTS_CA_BUNDLE env var (#3829)

[daviediao-code]

Summary

Fixes #3829 — verify=False is ignored when REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE env var is set.

Root Cause

In merge_environment_settings, the condition if verify is True or verify is None: means the env var check runs when verify is either True (default) or None (unset). When verify=False is explicitly set, the env var check is skipped — but when session.verify=False is set and no param is passed (verify=None), the env var overrides the session's explicit False.

Fix

Changed if verify is True or verify is None: → if verify is True:

This ensures env vars only apply when the user has not explicitly set verify at all (i.e., when it defaults to True).

Scenario	Before	After
requests.get(url, verify=False)	✓ False	✓ False
session.verify=False; session.get(url)	✗ env var wins	✓ False
requests.get(url) + CA_BUNDLE	✓ CA_BUNDLE	✓ CA_BUNDLE

Test

Added test_verify_false_precedence_over_env_certs to verify the fix.