[Sec-Infra] Consume tracked-context in Vulnerability#reachability and GraphQL

Part of &21396 (Complete at Scale Vulnerability Management).

Problem

ee/app/models/ee/vulnerability.rb #reachability and the VulnerabilityType GraphQL BatchLoader resolve reachability against the deduplicated Vulnerability, so a vulnerability tracked on a non-default branch reports the default branch's reachability.

Approach (revised)

Reachability is a characteristic of a specific finding (vulnerability_occurrence), not the deduplicated Vulnerability, and the finding already carries the tracked context. So both consumers resolve reachability per finding via Sbom::Occurrence.filter_by_vulnerability_occurrence_id(finding.id), which joins sbom_occurrences_vulnerabilities on vulnerability_occurrence_id.

This replaces the earlier plan to filter through sbom_occurrence_refs by tracked context (that approach, and the for_tracked_context scope from !241041 (merged), has been dropped; the scope is removed in !241593 (merged)).

Dependencies (blocking)

sbom_occurrences_vulnerabilities.vulnerability_occurrence_id is currently NULL in production. Both consumer MRs are blocked until it is populated:

• #592746 (!228448 (merged)) - set vulnerability_occurrence_id during SBOM ingestion
• #602158 - backfill vulnerability_occurrence_id for existing rows (BBM)
• #589839 - consistency check for the backfill

Implementation

• !241042 - Vulnerability#reachability finding-keyed (Draft, blocked)
• !241043 - GraphQL VulnerabilityType reachability finding-keyed BatchLoader (Draft, blocked)