Instrument triage_vulnerability UX SLI

What does this MR do and why?

Instruments the Triage and remediate a vulnerability customer journey SLI (https://gitlab.com/gitlab-org/gitlab/-/work_items/596316).

• Adds config/user_experience_slis/render_vulnerability.yml with feature_category: vulnerability_management and urgency: async_fast (15-second apdex threshold).
• Adds Gitlab::Graphql::UxSliByOperationName, a mapper class that resolves a GraphQL operationName to a UX SLI ID. EE extends it to map projectVulnerabilities, groupVulnerabilities, and instanceVulnerabilities to :render_vulnerability.
• Adds around_action :track_user_experience_sli_by_operation_name to GraphqlController. This starts tracking before the query is parsed or executed, accurately capturing total user-perceived latency. It also scopes tracking to only the specific operations we care about, avoiding false attribution from other callers of VulnerabilitiesResolver.
• Removes the previous resolver-level instrumentation that only wrapped fetch_vulnerabilities (a small fraction of the full request).

How does the apdex counter work?

gitlab_user_experience_total is incremented on every request completion (success or error). gitlab_user_experience_apdex_total is incremented only on successful completions, with success: true when the elapsed time is within the urgency threshold (≤ 15 s for async_fast), and success: false otherwise. The SLO is the ratio of satisfied requests.

How to set up and validate locally

1. Enable Prometheus metrics in your GDK.
2. Navigate to a project's Secure > Vulnerability report.
3. Apply a severity or state filter.
4. Query Prometheus for:
   • gitlab_user_experience_total{user_experience_id="render_vulnerability"}
   • gitlab_user_experience_apdex_total{user_experience_id="render_vulnerability"}
5. Confirm both counters increment on each page load and filter change.

MR acceptance checklist

• SLI YAML definition exists at config/user_experience_slis/render_vulnerability.yml
• Instrumentation emits gitlab_user_experience_total and gitlab_user_experience_apdex_total with correct labels
• Tracking starts at the controller level (before query parsing) via around_action, not inside the resolver
• Operation name mapping is tested in isolation
• EE extension is in ee/lib/ee/ following GitLab EE conventions

Related https://gitlab.com/gitlab-org/gitlab/-/work_items/596316