Ingest only successful security scans

What does this MR do and why?

Ingestion now only uses security scans that have stored all their findings (succeeded).

Before, it also used scans from failed jobs (job_failed) and scans that were still storing findings (preparing). Those scans have none or only part of their findings stored. Ingestion treated what it found as the scanner's full result, so it marked the missing vulnerabilities as no longer detected. With an auto-resolve policy, they were then resolved and detected again by the next pipeline.

A preparing scan is still ingested later, by the ingestion that runs once it finishes storing its findings.

Behind the ingest_only_successful_security_scans flag.

References

Related #635067

How to set up and validate locally

1. Fork or import security-reports
2. Add a vulnerability management policy that auto-resolves vulnerabilities that are no longer detected.
3. Run a pipeline on main. The vulnerabilities from samples/sast-eslint.json show as detected in the vulnerability report.
4. Make the sast-eslint job fail but still upload its report, and commit to main:

sast-eslint:
  script:
    - echo NOOP
    - exit 1
  artifacts:
    when: always
    reports:
      sast: samples/sast-eslint.json

In real pipelines this happens when an analyzer is killed after it writes its report, for example when it runs out of memory.

5. All sast-eslint vulnerabilities are marked as no longer detected, and with the policy they are also resolved. The scan's status is job_failed:
6. Remove exit 1 and commit again. The vulnerabilities are detected again.

With ingest_only_successful_security_scans enabled, step 5 doesn't mark anything as no longer detected.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.