Add security attribute filters to group vulnerability GraphQL

What does this MR do and why?

The group vulnerability report needs to include or exclude findings based on project security attributes. Add the GraphQL arguments and availability checks first, so the API contract is stable before the filter is wired through to Elasticsearch.

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #628986 (closed)