Support remediations in Dependency Scanning report

Lukas Eipertrequested to merge
5656-add-fe-store-support-for-remediations-ee into master

What does this MR do?

This adds support for the new remediations to the Dependency Scanning store. It searches the matching remediation for a vulnerability. The new report format looks like this (shortened). So in that example the last two vulnerabilities are fixed by the same remediation, while the first has no fix.

{
  "version": "2.0",
  "vulnerabilities": [
    {
      "category": "dependency_scanning",
      "cve": "rails/Gemfile.lock:nokogiri:gemnasium:78658378-bd8f-4d79-81c8-07c419302426",
      "more-info": "..."
    },
    {
      "category": "dependency_scanning",
      "cve": "yarn/yarn.lock:debug:gemnasium:37283ed4-0380-40d7-ada7-2d994afcc62a",
      "more-info": "..."
    },
    {
      "category": "dependency_scanning",
      "cve": "yarn/yarn.lock:saml2-js:gemnasium:9952e574-7b5b-46fa-a270-aeb694198a98",
      "more-info": "..."
    }
  ],
  "remediations": [
    {
      "diff": "...",
      "fixes": [
        {
          "cve": "yarn/yarn.lock:saml2-js:gemnasium:9952e574-7b5b-46fa-a270-aeb694198a98"
        },
        {
          "cve": "yarn/yarn.lock:debug:gemnasium:37283ed4-0380-40d7-ada7-2d994afcc62a"
        }
      ],
      "summary": "Upgrade to saml2-js@1.14.2"
    }
  ]
}

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

Merge request reports