Add new group vulnerability report and vulnerability counts components

What does this MR do and why?

Currently, the vulnerability report's structure assumes that there are only 4 report types (project, group, instance, and pipeline), and the design is rather inflexible. We now have 2 new report levels that need to be added, and potentially more in the future.

This MR is the beginning of a refactor to make the vulnerability report more flexible and reusable. It's currently only for the group-level report and only shows the vulnerability counts. Because it's still under development, it's behind the :operational_vulnerabilities feature flag.

Screenshots or screen recordings

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #338790 (closed)