Add security bot comment for policy violations in MRs

What does this MR do and why?

This MR adds security bot comments for policy violations in MRs.

This change introduces an automatic comments on the MRs where security policy violations are detected. It adds guidance for the user on what to do next with regards to the needed approvals.

The comments are created by security bot. We may switch to a dedicated security policy bot from #394958 (closed), but for the moment, we plan to test this feature with the security bot.

This feature is added behind a feature flag.

Screenshots or screen recordings

With violations:

Resolved violations:

Recording:

lightweight_bot_comment

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

1. Enable the feature flags in the rails console:

   Feature.enable(:security_policy_approval_notification)

2. Add secret detection template into .gitlab-ci.yml:

   include:
     - template: Jobs/Secret-Detection.gitlab-ci.yml
   test-job:
     script:
     - echo "Test Job..."

3. Create a new project with a security policy. Example:

   type: scan_result_policy
   name: Secrets
   description: ''
   enabled: true
   rules:
     - type: scan_finding
       branches: []
       scanners:
         - secret_detection
       vulnerabilities_allowed: 0
       severity_levels:
         - critical
         - high
         - medium
         - low
         - unknown
         - info
       vulnerability_states:
         - new_needs_triage
         - new_dismissed
   actions:
     - type: require_approval
       approvals_required: 1
       user_approvers_ids:
         - 4

4. Introduce a policy violation in an MR - for example, add a secret which would trigger secret detection scanner from a policy.

5. After the CI has finished, observe an automatic comment being added.

6. Add a new commit which doesn't fix the violation yet. There shouldn't be any new automatic comment.

7. Add a new commit, fixing the violation.

8. The comment should get updated and say that violations have been fixed.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #411656 (closed)

app/models/note.rb

@@ -141,6 +141,7 @@ class Note < ApplicationRecord
   scope :with_discussion_ids, ->(discussion_ids) { where(discussion_id: discussion_ids) }
   scope :with_suggestions, -> { joins(:suggestions) }
   scope :inc_author, -> { includes(:author) }
+  scope :authored_by, ->(user) { where(author: user) }
   scope :inc_note_diff_file, -> { includes(:note_diff_file) }
   scope :with_api_entity_associations, -> { preload(:note_diff_file, :author) }
   scope :inc_relations_for_view, ->(noteable = nil) do