Fix Dependency Scanning QA
What does this MR do?
Fix QA after $REPORT has been renamed in 341c2a1c but not everywhere.
What are the relevant issue numbers?
None.
Does this MR meet the acceptance criteria?
On a side note, I have no idea yet how QA could still work for Dependency Scanning, unless $REPORT would be defined somewhere else, in another file.