Prefer scan.scanner over vulnerabilities[].scanner

Why are we doing this work

As discussed in #370925 (comment 1072627524), we no longer accept vulnerabilities[].scanner in the security report schema versions 15-0-0 and above.

However, until we remove support for versions 14-x-x, we still need to honour the property. As @minac said:

we need to change the current logic to use the scan.scanner if the vulnerabilities[].scanner does not exist

Perhaps a better approach is to do the opposite: use scan.scanner and, if absent, fallback to vulnerabilities[].scanner.

Relevant links

Non-functional requirements

• Documentation:
• Feature flag:
• Performance:
• Testing:

Implementation plan

• Adjust create_scanner method in lib/gitlab/ci/parsers/security/common.rb to try report_data["vulnerabilities"].first["scanner"] if top_level_scanner returns no data
• Create a spec for this scenario
  • Try loading an existing report fixture for this spec and remove the scan.scanner entry in memory instead of creating a new fixture

Verification steps

1. Put this feature behind a feature flag
2. Create a project under https://gitlab.com/gitlab-org/secure/tests
3. Enable FF for that project
4. Push a report that doesn't contain scan.scanner property
5. Verify that the scanner gets populated correctly in the database