Enable FP detection for tracked non-default branches

What does this MR do and why?

Runs SAST false-positive (FP) detection automatically for new findings on tracked non-default branches. The FP workflow now runs against the finding's own branch, not the project default branch. This only applies when the fp_detection_non_default_branches feature flag (beta, off by default) and VAC are both enabled.

• Ingestion (Security::Ingestion::Tasks::HooksExecution): new findings on tracked non-default branches are now eligible, but only SAST findings on branches. Tags, untracked contexts and non-SAST findings are still skipped.
• SAST FP flow (Ai::Catalog::FoundationalFlow::SastFpDetection::Definition): adds a source_branch_resolver that reads the vulnerability ID from the goal and uses the new Vulnerability#fp_detection_source_branch. This covers automatic runs, restarts and API starts. It returns nil for default-branch, tag or missing contexts, or when the flag/VAC is off, so the existing default-branch behavior stays the same.
• Resolution workflow (Vulnerabilities::Flag): adds a default_context? guard. Vulnerability resolution always runs on the default branch, so it must not auto-run for findings from non-default contexts.
  • This guard is intentionally not behind fp_detection_non_default_branches. With the flag off, FP flags can still be created for non-default-context findings (through after_create_commit or bulk runs), and auto-VR would then resolve them on the default branch. The guard stops that in all cases.

Before (master)

	SAST FP	Secret Detection FP	VR (auto)
Default branch	Runs on default branch	Runs on default branch (if configured)	Runs on default branch (if configured)
Non-default branches	Not triggered	Not triggered	Not triggered
Tags	Not triggered	Not triggered	Not triggered

After (VAC + fp_detection_non_default_branches on)

	SAST FP	Secret Detection FP	VR (auto)
Default branch	Unchanged: runs on default branch	Unchanged: runs on default branch	Unchanged: runs on default branch
Tracked non-default branches	✅ Runs on the finding's own branch	Unchanged: not triggered	Unchanged: not triggered
Untracked non-default branches	Unchanged: not triggered	Unchanged: not triggered	Unchanged: not triggered
Tracked tags	Unchanged: not triggered	Unchanged: not triggered	Unchanged: not triggered

"Not triggered" means not auto-triggered at ingestion. Bulk runs and vulnerabilities created through CreateService (after_create_commit) can still start FP detection for any context, as on master.

Note: The following will be addressed in a follow-up MR:

• Secret Detection FP on non-default branches
• VR on non-default branches

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.