Show Vulnerability Context Flow last run in the vulnerability report

What does this MR do and why?

Shows the status of the Vulnerability Context Flow in the project vulnerability report, next to Security reports last updated and SBOMs last updated:

• Vulnerability Context Flow last updated with the time of the last finished run.
• Vulnerability Context Flow running while a run is in progress.
• Failed in red when the last run failed or was stopped.

It shows nothing when:

• The flow has never run for the project.
• The flow is turned off for the project, or the GitLab Duo Agent Platform isn't available.
• The user can't read the session (no GitLab Duo access). This includes the Security Manager role, which can see vulnerabilities but not flow sessions.

No Retry button. The flow only runs after a push, and there is no way to start it by hand yet.

Not in this MR:

• The same status in the vulnerability page header. That's a separate MR.
• Removing the message under the settings toggle. That's the cleanup step in the issue.

References

• Closes https://gitlab.com/gitlab-org/gitlab/-/work_items/637843
• Message under the settings toggle: https://gitlab.com/gitlab-org/gitlab/-/work_items/635404
• Epic: https://gitlab.com/groups/gitlab-org/-/work_items/21005

Screenshots or screen recordings

Before	Finished	Running	Failed

How to set up and validate locally

1. Use a project where the Vulnerability Context Flow has run at least once and is turned on, for example gitlab-duo/cheat-small in GDK.

2. Go to Secure > Vulnerability report.

3. Check that Vulnerability Context Flow last updated shows the time of the last run.

4. To see the other states, set the latest session's status in the Rails console, then reload the page:

   project = Project.find_by_full_path('gitlab-duo/cheat-small')
   workflow = Ai::DuoWorkflows::Workflow.where(project: project, workflow_definition: 'business_context_security_guidelines/experimental').last
   workflow.update_column(:status, Ai::DuoWorkflows::Workflow.state_machines[:status].states[:running].value) # or :failed

5. Check that running shows Vulnerability Context Flow running with "running" in blue, and failed shows Failed and the time in red.

6. Set the status back to :finished when you're done.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.