Preload state transition authors for security findings

What does this MR do and why?

Security::Finding.with_state_transitions now preloads state_transitions: :author (with_vulnerability.preload(state_transitions: :author)) instead of includes(:state_transitions).

preload is required rather than includes/a join because users lives on the main database while state_transitions lives on the sec database, so the two must never be joined.

Vulnerabilities::FindingEntity exposes state_transitions through Vulnerabilities::StateTransitionEntity, which exposes author through UserEntity. Without the preload, serialization triggers one User lookup per state transition. with_state_transitions backs Security::FindingsFinder, so this affects the MR security report comparison (Vulnerabilities::CompareSecurityReportsService) and the vulnerability findings REST API.

Benchmark on GDK, running the whole CompareSecurityReportsService#execute for 25 added + 25 fixed findings, with 18,000 state transitions spread across 100 distinct authors (query cache cleared before each run, 2 runs each):

Benchmark results

	wall time	allocations	main DB queries	query cache hits
before	26.8–26.9 s	83.8 M	107	14,921
after	20.8–21.0 s	76.1 M	12	17

Most of the remaining time is per-transition UserEntity serialization (avatar_url → GravatarService → Gitlab::CurrentSettings). That's noted in the issue and is out of scope for this MR.

References

Closes #631157 (closed)

Found while benchmarking !256395 (merged)

Screenshots or screen recordings

Not applicable, backend-only change.

How to set up and validate locally

1. Run the query count spec:

   bundle exec rspec ee/spec/models/security/finding_spec.rb -e '.with_state_transitions'

2. Optional manual check: in a rails console, load Security::Finding.with_state_transitions for findings whose vulnerabilities have transitions from several different authors, then iterate finding.state_transitions.map(&:author). Confirm the query log shows a single users query instead of one per author.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.