[DQT] Fix visit list filtering in candidate matching (aces#10438)

## Description
Fixes a bug where DQT filters did not apply visit list criteria when
matching candidates. The `getCandidateMatches()` method was not passing
the `$visitlist` parameter to `buildQueryFromCriteria()`, and the visit
filtering logic in `buildQueryFromCriteria()` was incorrectly adding a
duplicate session table join.

## Changes
- **src/Data/Query/SQLQueryEngine.php**: 
- Pass `$visitlist` parameter to `buildQueryFromCriteria()` in
`getCandidateMatches()` method
- Remove duplicate session table join from `buildQueryFromCriteria()` -
the session table is already joined by `getFieldNameFromDict()` when
querying session-scoped fields
- **modules/dataquery/php/query.class.inc**: Remove FIXME comment and
simplify visit list assignment since functionality is now verified

## Testing Instructions
1. Navigate to the Data Query Tool
2. Select fields with session scope
3. Add a filter on a parameter and select only a subset of visits (e.g.,
only "V1" and "V2")
4. Run the query
5. Verify that results only include data from the specified visits
6. Compare with results when all visits are selected - should see
different candidate counts

## Related Issues
Resolves aces#10435

Author: HenriRabalais

modules/dataquery/php/query.class.inc

@@ -761,11 +761,7 @@ class Query implements \LORIS\StudyEntities\AccessibleResource,
                     throw new \Exception("Unhandled operator: " . $crit['op']);
                 }
 
-                // FIXME: Verify visits, test was done with candidate scope data
-                $visitlist = null;
-                if (isset($crit['visits'])) {
-                    $visitlist = $crit['visits'];
-                }
+                $visitlist = $crit['visits'] ?? null;
 
                 \Profiler::checkpoint("Calling engine get matches");
                 $matches = $engine->getCandidateMatches($term, $visitlist);

modules/imaging_browser/php/queryengine.class.inc

@@ -375,7 +375,10 @@ class QueryEngine extends \LORIS\Data\Query\SQLQueryEngine
         \LORIS\Data\Dictionary\DictionaryItem $item
     ): string {
         if ($item->getName() == 'ScanDone') {
-            $this->addTable('LEFT JOIN session s ON (s.CandidateID=c.ID)');
+            $this->addTable(
+                "LEFT JOIN session s "
+                . "ON (s.CandidateID=c.ID AND s.Active='Y')"
+            );
                 return "CASE WHEN s.Scan_Done='Y' THEN true
                              WHEN s.Scan_Done='N' THEN false
                              ELSE NULL END";
@@ -392,7 +395,10 @@ class QueryEngine extends \LORIS\Data\Query\SQLQueryEngine
         // $field = whatever's after the first underscore
         $field = substr($item->getName(), strpos($item->getName(), '_') + 1);
 
-        $this->addTable('LEFT JOIN session s ON (s.CandidateID=c.ID)');
+        $this->addTable(
+            "LEFT JOIN session s "
+            . "ON (s.CandidateID=c.ID AND s.Active='Y')"
+        );
         $this->addTable("LEFT JOIN files ON (s.ID=files.SessionID)");
 
         if ($item instanceof LocationDictionaryItem) {
@@ -544,7 +550,10 @@ class QueryEngine extends \LORIS\Data\Query\SQLQueryEngine
             || $item instanceof MRICommentDictionaryItem
             || $item instanceof MRIPredefinedCommentDictionaryItem
         ) {
-            $this->addTable('LEFT JOIN session s ON (s.CandidateID=c.ID)');
+            $this->addTable(
+                "LEFT JOIN session s "
+                . "ON (s.CandidateID=c.ID AND s.Active='Y')"
+            );
             $this->addTable("LEFT JOIN files ON (s.ID=files.SessionID)");
             return "SUBSTRING_INDEX(files.File, '/', -1)";
         }

src/Data/Query/SQLQueryEngine.php

@@ -116,7 +116,7 @@ public function getCandidateMatches(
         $this->addWhereClause("c.Active='Y'");
         $prepbindings = [];
 
-        $this->buildQueryFromCriteria($term, $prepbindings);
+        $this->buildQueryFromCriteria($term, $prepbindings, $visitlist);
 
         $query = 'SELECT DISTINCT c.CandID FROM';