Enable malware detection by default on vulnerability and dependency pages

What does this MR do and why?

Enables two beta feature flags for malware detection by flipping default_enabled from false to true: vulnerability_malware_detection (shows the malware badge and findings on the vulnerability report and vulnerability details pages) and dependency_malware_detection (shows the malware badge on the project and group dependency lists, and the malware field in the dependency list JSON export). This activates the malware detection UI by default across GitLab.com, Self-Managed, and Dedicated. Both flags were introduced (disabled) in GitLab 19.4 by !249360 (merged) and are being enabled in the same release, so the documentation history entries are combined into a single "Enabled by default" entry.

The dependency list malware filter depends on a separate flag malicious_packages_dependency_list_filtering (type wip, still disabled by default), which is not changed here. Only the dependency list malware badge and JSON field are enabled by default; the filter's documentation note is left as "Disabled by default."

Please confirm the rollout issue checklists are complete before merging.

References

• Rollout issue for vulnerability_malware_detection: #597347
• Feature issue for vulnerability_malware_detection: #587647 (closed)
• Rollout issue for dependency_malware_detection: #611434
• Feature issue for dependency_malware_detection: #587758
• Introducing MR (UI implementation): !249360 (merged)

Screenshots or screen recordings

No UI code change in this MR, only the default flag state changes. The malware detection UI was implemented in the introducing MR !249360 (merged) and is now enabled by default without modification.

How to set up and validate locally

1. Check out this branch in a fresh GitLab checkout.

2. In a Rails console, confirm both flags default to true:

   Feature.enabled?(:vulnerability_malware_detection)  # => true
   Feature.enabled?(:dependency_malware_detection)     # => true

3. Using a project that has existing malware findings, verify the malware badge appears by default on the vulnerability report page, the vulnerability details page, and the dependency list, without any manual Feature.enable calls.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

• Feature flag rollout issue checklists completed and confirmed (linked above).
• Documentation history entries verified.