Because WebFlow is completly unaware of the underlying transport mechanism. The fact that you use Http isn't interesting for webflow. You could also build it on top of another protocol (JMS or something), just write some converters for the RequestContext and presto.
These objects have more than just attributes, so not sure why only the attribute/paramter map is exposed.
Regarding your question I would say read the javadocs and look at the API.
ServletExternalContext servletCtx = (ServletExternalContext)externalContext;
HttpServletRequest request = (HttpServletRequest) servletCtx.getNativeRequest();
HttpSession session = request.getSession();