Alert API and tree refresh load alerts from all sessions instead of current session

Describe the bug:

Summary

Three call sites in ExtensionAlert and AlertAPI suppress the
session-scoped alert query and fall back to loading all alerts from all
sessions. The suppressed method is fully implemented in both DB backends.

Affected files

• zap/src/main/java/org/zaproxy/zap/extension/alert/ExtensionAlert.java — lines 715, 985
• zap/src/main/java/org/zaproxy/zap/extension/alert/AlertAPI.java — line 498

Current behavior

All three sites contain this pattern:

// TODO this doesn't work, but should be used when its fixed :/
// Vector<Integer> v =
//   tableAlert.getAlertListBySession(Model.getSingleton().getSession().getSessionId());
Vector<Integer> v = tableAlert.getAlertList();

getAlertList() returns every alert from every session ever stored in
the database. This means:

• The Alerts tree after a session reload shows alerts from prior sessions
• The REST API /JSON/alert/view/alerts/ returns cross-session results
• CI/CD pipelines that check alert counts via the API see false positives
  from previous scans

Root cause

getAlertListBySession(sessionId) is fully implemented in both
ParosTableAlert and SqlTableAlert with correct SQL JOINs. It was
commented out at these call sites with an unresolved TODO.

Proposed fix

Uncomment the three suppressed call sites. I'd like to confirm with
maintainers:

1. Is there a known reason the session-scoped method was thought to be
   broken — or was this just left as future work?
2. Is a changelog entry expected for this behavior change?

Happy to submit a PR once the approach is confirmed.

Steps to reproduce the behavior:

1. Run ZAP and perform a scan on any target site
2. Save the session (File > Save Session)
3. Close ZAP and reopen it
4. Load the saved session (File > Open Session)
5. Call the REST API endpoint: http://localhost:8080/JSON/alert/view/alerts/
6. Observe that alerts from previous sessions appear mixed with current session alerts

Expected behavior:

The alerts returned by the API and displayed in the Alerts tree should be
scoped to the current session only. Alerts from previous sessions should
not appear in the current session's view.

Root cause identified in source: three call sites in ExtensionAlert.java
(lines 715, 985) and AlertAPI.java (line 498) suppress the session-scoped
query getAlertListBySession(sessionId) and fall back to getAlertList()
which returns all alerts from all sessions. The suppressed method is fully
implemented in both ParosTableAlert and SqlTableAlert. I would like to
propose uncommenting these three call sites as a fix.

Software Versions:

ZAP Version: 2.17.0
Java Version: 17.0.17
OS: macOS 15 (Apple M3)

Screenshots:

No response

Errors from the zap.log file:

No response

Additional context:

No response

Would you like to help fix this issue?

• Yes

Start with the three call sites in zap/src/main/java/org/zaproxy/zap/extension/alert/ExtensionAlert.java and AlertAPI.java, then inspect getAlertListBySession in ParosTableAlert and SqlTableAlert. Reproduce the saved-session behavior and call the alerts API; done means the Alerts tree and endpoint return only alerts from the current session, with no results from prior sessions.