feat(vulnerabilities): expose Vulnerability Management (Ultimate)

[polaz]

👍 React to this issue if you need this feature — helps us prioritise.

Problem

GitLab's Vulnerability Management surface is a major Ultimate-tier capability — list project vulnerabilities, dismiss false positives, confirm findings, revert dismissals. Critical for security teams, exposed by competing MCP servers (jmrplens, yoda-digital). We have nothing.

Investigation done (current state)

Verified against src/entities/:

• ❌ grep -ri 'vulnerabilit' src/ returns 20 hits — but all are in utils/error-handler.ts, cli/init/wizard.ts, graphql/workItems.ts referencing the word in OTHER contexts (e.g. dependency vulnerabilities). No actual vulnerability entity
• ❌ No entity vulnerabilities/ exists
• ✅ Our test instance is Ultimate (git-test.private.systems) — we can integration-test

Re-verify before coding:

grep -rIni 'vulnerabilit' src/entities/ src/graphql/
ls src/entities/ | grep -i vuln

Acceptance criteria

• New entity src/entities/vulnerabilities/ with:
  • browse_vulnerabilities actions: list (project / group / instance), get
  • manage_vulnerability actions: dismiss, confirm, resolve, revert (un-dismiss)
• Tier-gated: requires Ultimate (return clear error on Free/Premium)
• Integration test gated via describeIfTier('ultimate', ...) (helper already exists per test(integration): skip tier-gated suites when GitLab license unavailable #428)
• Consider both REST endpoints and GraphQL Vulnerability type — GraphQL likely richer for nested details

GitLab API

• REST: /api/v4/projects/:id/vulnerabilities + /vulnerabilities/:id/dismiss/confirm/resolve/revert
• GraphQL: Vulnerability type + vulnerabilityDismiss, vulnerabilityConfirm, etc. mutations
• Tier: Ultimate
• Docs: https://docs.gitlab.com/api/vulnerabilities/
• New in 18.x: originalSeverity field on PipelineSecurityReportFinding GraphQL — additive, include in get response

Estimate

1.5d

Context

Found during GitLab 18→19 API landscape analysis. Real Ultimate-tier wedge — competitors mostly skip it.