The documented solution is to use Named Credentials:
To call Salesforce APIs, make the API calls from your component’s Apex controller. Use a named credential to authenticate to Salesforce.
The Session Id exposed to your Aura Apex controllers is not API enabled.
Calling the Tooling API requires elevated privileges. Your Named Credential would be exposing the ability to make API calls as a privileged, likely System Administrator user account.
Both this security facet and the fact of calling the Tooling API itself, which can mutate some metadata in an active org, entails not-inconsiderable risks to your production Salesforce. Consider very carefully before proceeding with such an implementation, and take great care to validate all input thoroughly before making a Tooling API call.