Fix for #25141 - make field final

Based on review suggestion

nucleus/security/core/src/main/java/com/sun/enterprise/security/SecurityContext.java

@@ -75,7 +75,7 @@ public class SecurityContext extends AbstractSecurityContext {
     // Did the client log in as or did the server generate the context
     private boolean serverGeneratedSecurityContext;
 
-    private ThreadLocal<Principal> sessionPrincipal = new ThreadLocal<>();
+    private final ThreadLocal<Principal> sessionPrincipal = new ThreadLocal<>();
 
     /*
      * This creates a new SecurityContext object. Note: that the docs for Subject state that the internal sets (eg. the