Hide CVSS, EPSS, KEV, and Solution for malicious vulnerabilities

What does this MR do and why?

Hides irrelevant vulnerability enrichment fields (CVSS, EPSS, KEV, and Solution) on the Vulnerability Details page when a vulnerability is flagged as malicious. These fields are not applicable to malware detections — for example, CVSS/EPSS scores are designed for CVEs, and providing remediation solutions for malware carries legal liability concerns.

This is gated behind the malicious_package_detection feature flag (WIP, disabled by default).

Changes

• vulnerability_details.vue: Adds isMalicious computed property; conditionally hides CVSS, EPSS, and KEV sections when the vulnerability is malicious.
• footer.vue: Adds isMalicious computed property via glFeatureFlagMixin; conditionally hides the Solution card for malicious vulnerabilities.
• vulnerabilities_controller.rb: Pushes malicious_package_detection feature flag to the frontend.
• Feature flag: Adds malicious_package_detection WIP feature flag definition.
• Tests: Adds specs in footer_spec.js and vulnerability_details_spec.js covering show/hide behavior for malicious vs non-malicious vulnerabilities, including feature flag toggling.

References

• Related issue: #587655
• Parent epic: Display Malicious Package Information

Screenshots or screen recordings

Before	After

Feature flag

• Name: malicious_package_detection
• Type: WIP
• Default: disabled

How to set up and validate locally

Apply the following patch, so the vulnerability contains all the data-points that are needed to render the touched fields:

diff --git a/ee/app/assets/javascripts/vulnerabilities/vulnerabilities_init.js b/ee/app/assets/javascripts/vulnerabilities/vulnerabilities_init.js
index 6e15cb2ddff8..5ba2f0464dc7 100644
--- a/ee/app/assets/javascripts/vulnerabilities/vulnerabilities_init.js
+++ b/ee/app/assets/javascripts/vulnerabilities/vulnerabilities_init.js
@@ -26,6 +26,12 @@ export default (el) => {
     deep: true,
   });
 
+  vulnerability.solution = 'Update the affected package to a non-malicious version.';
+  vulnerability.cveEnrichment = {
+    epssScore: 0.01
+  };
+  vulnerability.isMalicious = false;
+
   const router = createRouter();
 
   return new Vue({

1. Enable the feature flag: http://gdk.test:3000/rails/features/malicious_package_detection
2. Navigate to a vulnerability's (CVE) details page.
3. Verify that CVSS, EPSS, KEV, and Solution sections are visible.
4. Within vulnerabilities_init.js set vulnerability.isMalicious = true
5. Verify that CVSS, EPSS, KEV and Solution sections are hidden.
6. Disable the feature flag
7. Verify that CVSS, EPSS, KEV and Solution sections are visible.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #587655