Add MttrOverTimeFinder

What does this MR do and why?

• Adds Search::AdvancedFinders::Security::Vulnerability::MttrOverTimeFinder, the backend for the "MTTR over time" chart.
• It runs the by_mttr_over_time aggregation from !256204 (merged). This MR targets that MR's branch, so the diff only shows the finder.
• Returns one entry per Monday–Sunday week with count, mttr (days) and sum_days. Empty weeks are zero-filled.
• Optional group_mttr_by (severity / report_type) adds a zero-filled breakdown per value.
• No active-state default, unlike RiskScoresFinder: MTTR needs resolved vulnerabilities. The aggregation excludes dismissed ones.
• Returns [] until the add_remediated_at_to_vulnerability Elasticsearch migration has finished.

References

• Implements #627300 (closed)
• Depends on !256204 (merged)
• GraphQL contract #626733 (closed)
• Epic &23458

Screenshots or screen recordings

Backend only, no UI changes.

How to set up and validate locally

1. Run the specs:

   bundle exec rspec ee/spec/lib/search/advanced_finders/security/vulnerability/mttr_over_time_finder_spec.rb ee/spec/lib/search/advanced_finders/security/vulnerability/bucket_parser_spec.rb

Also validated end-to-end in a GDK through the upcoming GraphQL field (#627302 (closed)) and the chart frontend.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code