This is done because the read_vulnerability policy is covering more
than only vulnerability authorization as mentioned here
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/36019#note_376049736

Changelog: changed
MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/58704
EE: true