Add support for querying epics with GraphQL

What does this MR do?

Allows one to query for epics using a Group GraphQL query.

Example

{
  group(fullPath: "h5bp") {
    id
    path
    fullPath
    epic(iid: 1) {
      id
      iid
      title
      path
      userPermissions {
        adminEpic
        createEpic
      }
      children {
        edges {
          node {
            id
            iid
            title
            state
            path
            reference(full: true)
            relationPath
            createdAt
            closedAt
            hasChildren
            hasIssues
            userPermissions {
              adminEpic
              createEpic
            }
            group {
              fullPath
            }
          }
        }
      }
      issues {
        edges {
          node {
            iid
            title
            closedAt
            state
            createdAt
            confidential
            webUrl
            dueDate
            weight
            path
            reference
            relationPath
            assignees {
              edges {
                node {
                  webUrl
                  name
                  username
                  avatarUrl
                }
              }
            }
            milestone {
              title
              startDate
              dueDate
            }
          }
        }
      }
    }
  }
}

This MR requires (and is based on) https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/13246. It has been extracted from https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/10999

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation created/updated or follow-up review issue created
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Performance and testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team

Closes #10795 (closed)

ee/spec/finders/security/vulnerabilities_finder_spec.rb

@@ -10,8 +10,8 @@
     set(:pipeline1) { create(:ci_pipeline, :success, project: project1) }
     set(:pipeline2) { create(:ci_pipeline, :success, project: project2) }
 
-    set(:vulnerability1) { create(:vulnerabilities_occurrence, report_type: :sast, severity: :high, pipelines: [pipeline1], project: project1) }
-    set(:vulnerability2) { create(:vulnerabilities_occurrence, report_type: :dependency_scanning, severity: :medium, pipelines: [pipeline2], project: project2) }
+    set(:vulnerability1) { create(:vulnerabilities_occurrence, report_type: :sast, severity: :high, confidence: :high, pipelines: [pipeline1], project: project1) }
+    set(:vulnerability2) { create(:vulnerabilities_occurrence, report_type: :dependency_scanning, severity: :medium, confidence: :low, pipelines: [pipeline2], project: project2) }
     set(:vulnerability3) { create(:vulnerabilities_occurrence, report_type: :sast, severity: :low, pipelines: [pipeline2], project: project2) }
     set(:vulnerability4) { create(:vulnerabilities_occurrence, report_type: :dast, severity: :medium, pipelines: [pipeline1], project: project1) }
 
@@ -53,6 +53,24 @@
       end
     end
 
+    context 'by confidence' do
+      context 'when high' do
+        let(:params) { { confidence: %w[high] } }
+
+        it 'includes only high confidence vulnerabilities' do
+          is_expected.to contain_exactly(vulnerability1)
+        end
+      end
+
+      context 'when low' do
+        let(:params) { { confidence: %w[low] } }
+
+        it 'includes only low confidence vulnerabilities' do
+          is_expected.to contain_exactly(vulnerability2)
+        end
+      end
+    end
+
     context 'by project' do
       let(:params) { { project_id: [project2.id] } }