According to this thread, a session is “synonymous with a TCP connection”. The language in Session Information Functions also supports this.
So, in the context of a session-level advisory lock, anything that shares the TCP connection will have access to the resource, and the resource won’t be released unless explicitly unlocked, or the TCP connection is terminated.