Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

2. Or, if no issue exists, describe the change:

Problem:
VertexAiSessionService constructed returned Session objects with the caller-provided userId instead of the userId returned by the Vertex AI Session API. That made getSession able to report the requester as the owner of a session even when the backend response belonged to a different user. listSessions had the same parsing issue for each listed session.

Solution:
Use the backend response userId when parsing listed sessions. For single-session reads, compare the backend response userId with the requested userId and fail closed on mismatch. This aligns the Java behavior with adk-python's VertexAiSessionService, which validates get_session_response.user_id and uses api_session.user_id for listed sessions.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Passed:

• ./mvnw -pl core -Dtest=VertexAiSessionServiceTest test
• env -u OPENAI_API_KEY -u ANTHROPIC_API_KEY -u GOOGLE_API_KEY ./mvnw test

The full reactor test run passed all modules. The provider API keys were intentionally unset so optional live LangChain4j provider tests remained skipped instead of depending on local OpenAI, Anthropic, or Gemini credentials.

Manual End-to-End (E2E) Tests:

Verified against a live Vertex AI Agent Engine using REST calls and the patched Java VertexAiSessionService.

• Created two throwaway sessions with distinct user IDs.
• Confirmed REST get returns the backend userId.
• Confirmed patched Java getSession returns the session for the matching user.
• Confirmed patched Java getSession fails closed when the requested user differs from the backend session owner.
• Confirmed patched Java listSessions preserves the backend userId.
• Deleted the throwaway sessions and verified filtered lists were empty.

Checklist

• I have read the CONTRIBUTING.md document.
• My pull request contains a single commit.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas. (No new hard-to-understand areas were introduced.)
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules. (N/A - no dependent changes.)

Additional context

This is a single-commit fix scoped to core session parsing and ownership validation.