Add a scan object to the json schema

Currently the Security reports contain vulnerabilities, but don't provide context on how these vulnerabilities were found. This MR introduces a scan field, which will provide some of this missing context.

Note:

• scan is an optional field (for backwards compatibility)
• all fields in scan are required, even messages
• the CHANGELOG has been updated to have somewhat consistent entries

This MR resolves issue gitlab-org/gitlab#37123 (closed).