[web/session] make sure not to modify an inner value of session.data (closes #11217958)
When we modify a mutable value stored in the session's data (dict-like object)
we prevent an alternative session data handler (eg. pyramid-redis-session)
from detecting this update and synchronizing it in its backend (like redis).