Cap group vulnerability autocomplete at the result limit

🤖 AI wrote this code from my instructions.

Unreviewed AI output often lands on reviewers and costs them time.
This MR is human verified: I read the full diff and ran the tests myself, because your time is as valuable as mine.

What does this MR do and why?

Vulnerability autocomplete in a group can return up to ten suggestions where five are intended.

Autocomplete::VulnerabilitiesAutocompleteFinder#group_vulnerabilities walks the group's projects in batches of ten and queries each batch with with_limit(DEFAULT_AUTOCOMPLETE_LIMIT). Every batch is added to one accumulator that is never trimmed, so the total is bounded by the batch count, not by the limit. The break also used >, so a first batch returning exactly five did not stop the walk.

project_vulnerabilities is unaffected: its single query carries the limit.

This trims the accumulator before returning and breaks as soon as the limit is reached.

How this was confirmed

The existing specs use one project, so every vulnerability lands in a single batch and the limit holds. The bug needs enough projects to span two batches.

The new spec creates eleven projects, each with one matching vulnerability. Against the unmodified finder:

expected: 5
     got: 6
21 examples, 1 failure

With the fix, 21 examples, 0 failures, and 39 examples, 0 failures when the group autocomplete service spec is included.

Two things made the setup non-obvious, in case the next person hits them:

• Project.has_vulnerabilities reads a flag on project_setting, not the vulnerabilities table, so the projects need mark_as_vulnerable!.
• Group-scoped vulnerability reads are matched on traversal_ids, which the factory does not populate on its own. Passing group: to the :with_read vulnerability factory handles it.

References

None.

How to set up and validate locally

bundle exec rspec ee/spec/finders/autocomplete/vulnerabilities_autocomplete_finder_spec.rb

21 examples, 0 failures. Reverting the finder change alone fails the new example with expected: 5, got: 6.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.