RUN AS-IF-FOSS - Add basic security merge request widget

What does this MR do?

Add basic security merge request widget for Core. It simply indicates whether security scans have run.

This is very much an MVC, and future iterations will change this dramatically.

Addresses #249543 (closed), part of &4388.

Screenshots

Video

Testing locally

1. Set up the GDK to run in FOSS_ONLY mode (put export FOSS_ONLY=1 in env.runit)
2. Run gdk restart
3. Enable the core_security_mr_widget feature flag
4. Create a project which runs SAST and/or Secret Detection
5. Open an MR which contains a secret in the diff, or code that our SAST analysers cover (e.g., a do-nothing .js file should do)
6. Let the pipeline run
7. Refresh the page

Does this MR meet the acceptance criteria?

Conformity

• [-] Changelog entry
• [-] Documentation (if required)
• Code review guidelines
• [-] Merge request performance guidelines
• Style guides
• [-] Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• [-] Tested in all supported browsers
• [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Related to #249543 (closed)