### Body

When user is logged in with a valid session and deactivated, refreshing the browser/reusing the session leads to an infinite redirection loop (which is stopped quickly by browser detecting the situation).

## Steps to Produce:

Make sure you are using two different browsers.
In Browser A:

Login as the normal user.

In Browser B:
1. Login as admin.
2. Go to Security > List Users
3. Disable a user by unchecking this box:
![image](https://github.com/apache/airflow/assets/595491/0c1af0c2-2203-466f-8329-cf03aa138695)

4. Now in browser A, refresh the page.
You'll see a message like this:
![image](https://github.com/apache/airflow/assets/595491/5d9292c7-1364-46c0-8d26-5426a095112e)
In the server logs, you'll see that a lot of requests have been made to the server.
![image](https://github.com/apache/airflow/assets/595491/0599869a-a2bd-48a4-9f68-5789f24bfa16)

# Expected behaviour

There should be no infinite redirection, but the request for the inactive user should be rejected and the user should be redirected to the login page.


### Committer

- [X] I acknowledge that I am a maintainer/committer of the Apache Airflow project.
#
#
from __future__ import annotations
import logging
from importlib import import_module
from flask import g, redirect
from airflow.configuration import conf
from airflow.exceptions import AirflowConfigException, AirflowException
from airflow.www.extensions.init_auth_manager import get_auth_manager
log = logging.getLogger(__name__)
def init_xframe_protection(app):
    """
    Add X-Frame-Options header.
    Use it to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.
    See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
    """
    x_frame_enabled = conf.getboolean("webserver", "X_FRAME_ENABLED", fallback=True)
    if x_frame_enabled:
        return
    def apply_caching(response):