[v15] Improve the tests for listing active sessions (#51441)

* Improve the tests for listing active sessions

Use a more standard table-driven test setup, as the previous
approach put the description of the test at the very end.

Also adds a bit more flexibility to allow for additional more
complicated tests to be added, and adds one additional test
case to verify that explicit deny rules work.

* Add more active sessions tests

No functional changes, just locking in the existing behavior
with more test coverage.