Use scoped feature flag for GQL vulnerabilities

What does this MR do?

This MR replaces uses of the feature_flag GraphQL field key with manual scoped calls to Feature.enabled? for fields related to standalone vulnerabilities on ProjectType and GroupType. This will allow us to enable first_class_vulnerabilities for specific projects for UAT.

#207437 (closed) #207438 (closed) #207440 (closed) #207442 (closed)

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.