Alerts should have more granular scoping than "fleet"

[smklein]

Currently, alerts are hard-coded to only be visible in the fleet scope, meaning that fleet operators see them.

But there are many conditions whereby a user within a silo would want access to alerts.

These include:

• Monitoring an instance for state changes (seems reasonable for a regular silo user)
• Notifications upon silo cert expiration (for silo admins, see: fm: add certificate diagnosis engine for expiring silo TLS certificates #11238)

This granularity could likely continue beyond silos, to individual project levels.

[hawkw]

Another use case for project-scoped alerts has been that we have historically really wanted to send alerts when an instance is started in violation of its affinity rules (if it has the "allow" policy), which we keep putting off.