Add Pub support to dependency scanning auto-remediation

What does this MR do and why?

Adds Pub, the Dart and Flutter package manager, to auto-remediation's supported package managers, so Dart and Flutter projects get merge requests bumping vulnerable dependencies like Ruby/Bundler, Go, Cargo and NuGet already do.

pub joins SUPPORTED_PACKAGE_MANAGERS in Eligibility, and 'pub' => 'pub' joins PACKAGE_MANAGER_MAPPING in JobBuilder as an identity entry, since the orchestrator's ecosystem name already matches GitLab's. SBOM/purl mapping, the Advisory Database, the updater and the orchestrator already handled Pub, so nothing else needed wiring.

References

• Closes #604604 (closed)
• Updater support: https://gitlab.com/gitlab-org/security-products/dependency-management/updater/-/merge_requests/199
• Part of epic gitlab-org#19244

How to set up and validate locally

1. Check out this branch, run GDK, and clone pub-ar-demo; commit pubspec.lock, the only source dependency scanning reads for Pub. Its README lists the expected result per dependency.

2. Add Jobs/Dependency-Scanning.v2.gitlab-ci.yml to the project's .gitlab-ci.yml.

3. Attach the auto-remediation profile to the project:

   project = Project.find_by_full_path('<your-project-path>')
   
   profile = Security::ScanProfiles::FindOrCreateService.execute(
     namespace: project.root_ancestor,
     identifier: 'dependency_scanning_post_processing').payload[:scan_profile]
   
   Security::ScanProfileProject.find_or_create_by!(
     security_scan_profile_id: profile.id, project_id: project.id)

4. Run a pipeline and check the merge requests from the Dependency Management service account: Security: Update jose from 0.3.4 to 0.3.5+2 under the default profile, four under major. Only jose is remediated under minor (an upstream dependabot-pub limitation). Pub jobs run several minutes longer, since dependabot-pub sets up a Flutter SDK first, even for pure-Dart projects.

MR list (major upgrades allowed):

MR view:

MR diff:

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.