Create VulnerabilityLocationType and supporting types

What does this MR do?

• Adds VulnerabilityLocationType
• Adds VulnerableDependencyType
• Adds VulnerablePackageType

Each of these allows us to send vulnerability location data in a GraphQL way. Currently it's being sent in a JSON blob string field

Issue: #208847 (closed)

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.