By whom and when can transaction malleability be applied? Once I create a transaction and relay it to the network, who can alter the transaction id? Can the transaction id change at any time or only when the transaction is confirmed or unconfirmed?
The underlying data cannot be changed, only the signature thus id can.  It can be altered by anyone with knowledge of how to alter digital signatures while not invalidating them.

If it's a valid transaction, either the altered or unaltered version can be included in the blockchain.

Once it's cemented into the blockchain, the signature thus id cannot be changed.