Add admin_vulnerability to custom roles

What does this MR do and why?

It adds the admin_vulnerability ability to custom roles.

Screenshots or screen recordings

How to set up and validate locally

1. Enable feature flag Feature.enable(:custom_roles_vulnerability)

2. Creates a personal access token with the API scope.

3. Pick a group with at least one project (project), pick a user who is member of this project (guest/reporter access level)

4. Create a custom role using the API: https://docs.gitlab.com/ee/api/member_roles.html#add-a-member-role-to-a-group

   • curl --request POST --header "Content-Type: application/json" --header "Authorization: Bearer $YOUR_ACCESS_TOKEN" --data '{"base_access_level" : 10, "read_vulnerability" : true, "admin_vulnerability": true }' "http://localhost:3000/api/v4/groups/$YOUR_GROUP_ID/member_roles"

   • You can also test without "read_vulnerability" : true which should not work (read_vulnerbility is a requirement for admin_vulnerability)

5. Associates the member with the role using the Group and Project Members API endpoint

   • curl --request PUT --header "Content-Type: application/json" --header "Authorization: Bearer $YOUR_ACCESS_TOKEN" --data '{"member_role_id": '$MEMBER_ROLE_ID', "access_level": 10}' "http://localhost:3000/api/v4/projects/$ID/members/$GUEST_USER_ID"

6. Go to vulnerability report page (eg. http://localhost:3000/flightjs/Flight/-/security/vulnerability_report), click on vulnerability and try to change the vulnerability status

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #412536 (closed)

db/migrate/20230522210320_add_admin_vulnerability_to_member_roles.rb

+# frozen_string_literal: true
+
+class AddAdminVulnerabilityToMemberRoles < Gitlab::Database::Migration[2.1]
+  def change
+    add_column :member_roles, :admin_vulnerability, :boolean, default: false, null: false
+  end
+end