SAST scanning in auto devops doesn't support GRADLE_OPTS

Summary

The Auto DevOps SAST scanning for a Gradle project uses the findbugs SAST scanner. This scanner does not support receiving custom GRADLE_OPTS. This can be useful in various circumstances, for example, to skip running tests (again) during SAST scanning.

An example of where it's possible to do this is with the gemnasium-maven security scanner (https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#configuring-specific-analyzers-used-by-dependency-scanning). There, users can specify the GRADLE_CLI_OPTS variable to pass environment variables to the gradle run. It would make sense to enable the same for the spotbugs-sast analyzer.

So one would expect something like the following to be possible:

spotbugs-sast:
  variables:
    GRADLE_CLI_OPTS: "-Dorg.gradle.daemon=false -Dskip.tests=true"