Disable creating `security_findings` by default

Create entries in `security_findings` table if the feature is enabled.

ee/app/services/security/store_scan_service.rb

@@ -19,6 +19,8 @@ module Security
     end
 
     def execute
+      return security_scan unless Feature.enabled?(:store_security_findings, project)
+
       StoreFindingsMetadataService.execute(security_scan, security_report)
       deduplicate_findings? ? update_deduplicated_findings : register_finding_keys
 

ee/config/feature_flags/development/store_security_findings.yml

+---
+name: store_security_findings
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/44312
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/276011
+milestone: '13.6'
+type: development
+group: group::threat insights
+default_enabled: false

ee/spec/services/security/store_scan_service_spec.rb

@@ -41,6 +41,37 @@ RSpec.describe Security::StoreScanService do
       known_keys.add(finding_key)
     end
 
+    context 'when the `store_security_findings` feature is not enabled' do
+      before do
+        stub_feature_flags(store_security_findings: false)
+      end
+
+      it 'does not call the `Security::StoreFindingsMetadataService`' do
+        store_scan
+
+        expect(Security::StoreFindingsMetadataService).not_to have_received(:execute)
+      end
+
+      context 'when the security scan already exists for the artifact' do
+        let_it_be(:security_scan) { create(:security_scan, build: artifact.job, scan_type: :sast) }
+
+        it 'does not create a new security scan' do
+          expect { store_scan }.not_to change { artifact.job.security_scans.count }
+        end
+      end
+
+      context 'when the security scan does not exist for the artifact' do
+        it 'creates a new security scan' do
+          expect { store_scan }.to change { artifact.job.security_scans.sast.count }.by(1)
+        end
+      end
+    end
+
+    context 'when the `store_security_findings` feature is enabled' do
+      before do
+        stub_feature_flags(store_security_findings: true)
+      end
+
       it 'calls the `Security::StoreFindingsMetadataService` to store findings' do
         store_scan
 
@@ -128,4 +159,5 @@ RSpec.describe Security::StoreScanService do
         end
       end
     end
+  end
 end