Add `links` and `message` field to VulnerabilityType

The `message` attribute represents the short description of a record
and the `links` attribute represents the external links reported by the
scanner.

Changelog: added
EE: true

doc/api/graphql/reference/index.md

@@ -14729,8 +14729,10 @@ Represents a vulnerability.
 | <a id="vulnerabilityhassolutions"></a>`hasSolutions` | [`Boolean`](#boolean) | Indicates whether there is a solution available for this vulnerability. |
 | <a id="vulnerabilityid"></a>`id` | [`ID!`](#id) | GraphQL ID of the vulnerability. |
 | <a id="vulnerabilityidentifiers"></a>`identifiers` | [`[VulnerabilityIdentifier!]!`](#vulnerabilityidentifier) | Identifiers of the vulnerability. |
+| <a id="vulnerabilitylinks"></a>`links` | [`[VulnerabilityLink!]!`](#vulnerabilitylink) | List of links associated with the vulnerability. |
 | <a id="vulnerabilitylocation"></a>`location` | [`VulnerabilityLocation`](#vulnerabilitylocation) | Location metadata for the vulnerability. Its fields depend on the type of security scan that found the vulnerability. |
 | <a id="vulnerabilitymergerequest"></a>`mergeRequest` | [`MergeRequest`](#mergerequest) | Merge request that fixes the vulnerability. |
+| <a id="vulnerabilitymessage"></a>`message` | [`String`](#string) | Short text description of the vulnerability. This may include the finding's specific information. |
 | <a id="vulnerabilitynotes"></a>`notes` | [`NoteConnection!`](#noteconnection) | All notes on this noteable. (see [Connections](#connections)) |
 | <a id="vulnerabilityprimaryidentifier"></a>`primaryIdentifier` | [`VulnerabilityIdentifier`](#vulnerabilityidentifier) | Primary identifier of the vulnerability. |
 | <a id="vulnerabilityproject"></a>`project` | [`Project`](#project) | Project on which the vulnerability was found. |
@@ -14976,6 +14978,17 @@ Represents an issue link of a vulnerability.
 | <a id="vulnerabilityissuelinkissue"></a>`issue` | [`Issue!`](#issue) | Issue attached to issue link. |
 | <a id="vulnerabilityissuelinklinktype"></a>`linkType` | [`VulnerabilityIssueLinkType!`](#vulnerabilityissuelinktype) | Type of the issue link. |
 
+### `VulnerabilityLink`
+
+Represents a link related to a vulnerability.
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="vulnerabilitylinkname"></a>`name` | [`String`](#string) | Name of the link. |
+| <a id="vulnerabilitylinkurl"></a>`url` | [`String!`](#string) | URL of the link. |
+
 ### `VulnerabilityLocationContainerScanning`
 
 Represents the location of a vulnerability found by a container security scan.

ee/app/graphql/types/vulnerabilities/link_type.rb

+# frozen_string_literal: true
+
+module Types
+  module Vulnerabilities
+    class LinkType < BaseObject # rubocop:disable Graphql/AuthorizeTypes(This can be only accessible through vulnerability type)
+      graphql_name 'VulnerabilityLink'
+      description 'Represents a link related to a vulnerability'
+
+      field :name, GraphQL::Types::String, null: true,
+            description: 'Name of the link.'
+
+      field :url, GraphQL::Types::String, null: false,
+            description: 'URL of the link.'
+    end
+  end
+end

ee/app/graphql/types/vulnerability_type.rb

@@ -20,6 +20,10 @@ module Types
     field :description, GraphQL::Types::String, null: true,
           description: 'Description of the vulnerability.'
 
+    field :message, GraphQL::Types::String, null: true,
+          description: "Short text description of the vulnerability. This may include the finding's specific information.",
+          method: :finding_message
+
     field :state, VulnerabilityStateEnum, null: true,
           description: "State of the vulnerability (#{::Vulnerability.states.keys.join(', ').upcase})"
 
@@ -45,6 +49,9 @@ module Types
     field :external_issue_links, ::Types::Vulnerability::ExternalIssueLinkType.connection_type, null: false,
           description: 'List of external issue links related to the vulnerability.'
 
+    field :links, [::Types::Vulnerabilities::LinkType], null: false,
+          description: 'List of links associated with the vulnerability.'
+
     field :location, VulnerabilityLocationType, null: true,
           description: 'Location metadata for the vulnerability. Its fields depend on the type of security scan that found the vulnerability.'
 

ee/spec/graphql/types/vulnerabilities/link_type_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSchema.types['VulnerabilityLink'] do
+  let(:expected_fields) { %i[name url] }
+
+  subject { described_class }
+
+  it { is_expected.to have_graphql_fields(expected_fields) }
+end

ee/spec/graphql/types/vulnerability_type_spec.rb

@@ -11,6 +11,7 @@ RSpec.describe GitlabSchema.types['Vulnerability'] do
        id
        title
        description
+       message
        user_notes_count
        state
        severity
@@ -29,6 +30,7 @@ RSpec.describe GitlabSchema.types['Vulnerability'] do
        dismissed_at
        notes
        external_issue_links
+       links
        has_solutions
        false_positive
        merge_request