Change operational vulnerabilities flag from project to user

What does this MR do and why?

This MR changes the :operational_vulnerabilities flag from a project-level flag to a user-level flag. This is so that we can enable it on production for certain users to verify that the vulnerability report refactor and developmental/operational tabs are working properly for all 3 report levels (project, group, and instance) before changing it back to a project-level flag.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #338790 (closed)