Fix setting the `organization_id` for vulnerability exports

What does this MR do and why?

Setting the organization_id logic was failing for the instance security dashboard because the author attribute of the export object gets assigned after the exportable= call.

An ActiveRecord callback to set this attribute before_save would be a better solution but the specs were failing for some reason and I was already quite tired to fix them so I had to stick with the current approach.