Enable FP detection for tracked tags

What does this MR do and why?

Runs SAST false-positive (FP) detection automatically for new findings on tracked tags. Builds on !258183 (merged), which did the same for tracked non-default branches and left tags out on purpose.

Uses the same gate as !258183 (merged): the fp_detection_non_default_branches feature flag (beta, off by default) and VAC must both be enabled.

• Ingestion (Security::Ingestion::Tasks::HooksExecution): drops the branch-only check, so new SAST findings on tracked tags now trigger FP detection. Untracked refs and non-SAST findings are still skipped.
• FP worker: no change. Vulnerability#fp_detection_source_branch already returns nil for tags, so the agent reads code through the API at the commit where the finding was detected, and its local checkout is the default branch. This matches manual FP runs on tags today.
• Resolution workflow: no change. The default_context? guard from !258183 (merged) already blocks automatic VR for tag findings.

Before (!258183 (merged), VAC + fp_detection_non_default_branches on)

	SAST FP	Secret Detection FP	VR (auto)
Default branch	Runs on default branch	Runs on default branch (if configured)	Runs on default branch (if configured)
Tracked non-default branches	Runs on the finding's own branch	Not triggered	Not triggered
Untracked non-default branches	Not triggered	Not triggered	Not triggered
Tracked tags	Not triggered	Not triggered	Not triggered
Untracked tags	Not triggered	Not triggered	Not triggered

After (VAC + fp_detection_non_default_branches on)

	SAST FP	Secret Detection FP	VR (auto)
Default branch	Unchanged: runs on default branch	Unchanged: runs on default branch	Unchanged: runs on default branch
Tracked non-default branches	Unchanged: runs on the finding's own branch	Unchanged: not triggered	Unchanged: not triggered
Untracked non-default branches	Unchanged: not triggered	Unchanged: not triggered	Unchanged: not triggered
Tracked tags	✅ Runs; reads code at the tag's commit	Unchanged: not triggered	Unchanged: not triggered
Untracked tags	Unchanged: not triggered	Unchanged: not triggered	Unchanged: not triggered

Note: For tag findings, the agent's local checkout is still the default branch, because the workflow only accepts a branch name. In two FP runs on tag findings, the agent read every file through the API at the tag's commit and never used the local checkout. See the decision. Making the local checkout match the finding's ref is tracked in #633758.

References

• Issue: #632898 (closed)
• Builds on: !258183 (merged)
• Epic: gitlab-org#23511
• Feature flag rollout: #632914
• Follow-up (local checkout at the finding's ref): #633758

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Make sure VAC is enabled for your project, and SAST FP detection is turned on.

2. In the Rails console, enable the feature flag:

   Feature.enable(:fp_detection_non_default_branches)

3. Create a tag in the project (for example v1.0.0) and track it:

   mutation {
     securityRefsTrack(input: {
       projectPath: "<group>/<project>"
       refs: [{ name: "v1.0.0", refType: TAG }]
     }) {
       trackedRefs { name }
       errors
     }
   }

4. Run a pipeline on the tag that produces a new Critical or High SAST finding.

5. Confirm an FP detection session starts for the tag finding, and that the session reads files at the tag's commit.

6. Untrack the tag, or disable the flag, and run a new pipeline. Confirm no FP detection session starts for new tag findings.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.