Resolve "Validate incoming identifiers belong to the project for the alert endpoint"

What does this MR do?

Validate that the environment and prometheus_metric_id belong to a specific project. Render 404 otherwise. See #7548

Moreover, scope alerts by the environment. See #7565 (closed)

What are the relevant issue numbers?

#7528 (closed) #7548 #7565 (closed)

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• Conforms to the database guides
• EE specific content should be in the top level /ee folder
• For a paid feature, have we considered GitLab.com plans, how it works for groups, and is there a design for promoting it to users who aren't on the correct plan?

Closes #7548, #7565 (closed)

/cc @sengelhard @joshlambert