Test button fix for vuln events

What does this MR do and why?

Fixes #557991 (closed).

When you click Test > Vulnerability events on a group webhook, we always ran the test against the group's first project with commits. If that particular project didn't have any vulnerabilities, the test failed with Ensure the project has vulnerabilities, even when other projects in the group had plenty. This made working webhooks look broken, since real vulnerability events fired just fine.

Now, when testing vulnerability events, we look for a project in the group hierarchy that actually has a vulnerability and use that one instead. If there isn't one anywhere in the group, we show a clearer error: Ensure the group has a project with vulnerabilities. All other triggers behave exactly as before.

How to reproduce the bug

1. In a group, create two projects: one with commits but no vulnerabilities, and one with at least one vulnerability.
2. Add a group webhook with Vulnerability events enabled.
3. Click Test > Vulnerability events.
4. Before this change: it fails with Ensure the project has vulnerabilities. After: it succeeds.

How to validate locally

• Run the test on a group where a non-first project has a vulnerability - it should now succeed.
• Run it on a group with no vulnerabilities at all - you should see the new group-level error message.
• Sanity-check another trigger (like push events) to confirm nothing changed there.