Limit flask-session to <0.6 (#36895)

(cherry picked from commit 0190ba3)

pyproject.toml

@@ -93,10 +93,12 @@ dependencies = [
     "cryptography>=0.9.3",
     "deprecated>=1.2.13",
     "dill>=0.2.2",
-    "flask-appbuilder==4.3.10",
+    "flask-appbuilder==4.3.11",
     "flask-caching>=1.5.0",
+    # Flask-Session 0.6 add new arguments into the SqlAlchemySessionInterface constructor as well as
+    # all parameters now are mandatory which make AirflowDatabaseSessionInterface incopatible with this version.
     "flask-login>=0.6.2",
-    "flask-session>=0.4.0",
+    "flask-session>=0.4.0,<0.6",
     "flask-wtf>=0.15",
     # Flask 2.3 is scheduled to introduce a number of deprecation removals - some of them might be breaking
     # for our dependencies - notably `_app_ctx_stack` and `_request_ctx_stack` removals.