Only check db/api.py for session in arguments

We were checking both db/api.py and db/sqlalchemy/api.py for session
in db apis, but db apis are only defined externall in db/api.py. This
rule will falsely match on non-api methods in db/sqlalchemy/api.py
which take a session argument. Passing the session around within this
module is considered a good thing.

Change-Id: Ibf5d1284b44013c736b6b70ca4fa5d706c365c7d
Merge "Only check db/api.py for session in arguments"