use bids.query to query sessions and scans

[Remi-Gau]

Note to myself: scans and sessions should be accessible by using bids.query, because there is no guarantee that the output structure of bids.layout will always have the same "shape" (it could literally change from one commit to the next without deprecation warning), where as the API of bids.query is guaranteed much better stability (and proper deprecation cycles).

Originally posted by @Remi-Gau in #542 (comment)