Principal confusion via cookie-before-bearer credential precedence

Session fixation in Apache Airflow 3.3.0 through 3.3.1 allows remote attackers to cause API requests to run under the wrong principal. JWTRefreshMiddleware caches the user from the session cookie in request.state, and get_user returns that identity before evaluating an explicit bearer token. Exploitation requires placement of the attacker's valid cookie in a victim client that submits a bearer token; the result is principal confusion and misattributed audit records, not direct privilege escalation.