Show ASCP security context in the vulnerability Risk panel

What does this MR do and why?

The Risk panel on the vulnerability details page now shows three more rows: Authentication, Authorization and Sensitive data. The values come from the ASCP component matched to the finding.

VulnerabilityType has no field for that component yet, so the data is passed through the HAML app data and mapped in from_haml.js. The shape matches the AscpComponent and AscpSecurityContext GraphQL types, so switching to the real field later only changes the query.

Serialization requires a new beta flag, vulnerability_ascp_security_context (default off), and the existing read_ascp_security_context permission. The page-level vulnerability_details_enrichment flag also has to be on, so nothing is visible to users yet.

References

• Iteration: Project & Security Context
• Follow-up that replaces the HAML detour: #600642
• Related to: #611108

Screenshots or screen recordings

Same vulnerability on both sides. With the flag off the four risk factors balance across two columns; with it on they stay in the first column and the security context takes the second.

Before	After

Each new row has a Beta badge and a popover explaining the field:

How to set up and validate locally

1. Enable both flags. Nothing shows with only one of them on:

   • http://gdk.test:3000/rails/features/vulnerability_details_enrichment
   • http://gdk.test:3000/rails/features/vulnerability_ascp_security_context

2. Attach a security context to a finding in a project that has vulnerabilities:

   project = Project.find_by_full_path('root/my-project')
   vulnerability = project.vulnerabilities.first
   
   scan = Security::Ascp::Scan.create!(
     project: project,
     scan_type: :full,
     scan_sequence: Security::Ascp::Scan.next_scan_sequence_for(project.id),
     commit_sha: SecureRandom.hex(20)
   )
   
   component = Security::Ascp::Component.create!(
     project: project, scan: scan,
     title: 'User authentication module', sub_directory: 'app/services/auth'
   )
   
   Security::Ascp::SecurityContext.create!(
     project: project, scan: scan, component: component,
     authentication_model: 'true', authorization_model: 'elevated', data_sensitivity: 'true'
   )
   
   Vulnerabilities::AscpComponentLink.create!(
     project: project, vulnerability_finding: vulnerability.finding, ascp_component: component
   )

3. Open that vulnerability. The Risk panel shows Authentication: Yes, Authorization: Elevated and Sensitive data: Yes.

Blank context fields, a component without a context, and a finding without a component should all leave the Risk panel looking as it does on master.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.