Remove stale internal-analyzer findings when affected components are cleared

[heyiamwahab236]

Description

Fixes stale findings left behind by the internal analyzer. Updating an INTERNAL
vulnerability synchronizes its VulnerableSoftware records, but findings previously
created by the internal analyzer were never removed. Since the internal analyzer only
ever adds findings, clearing all affected components from a vulnerability left the
matched components carrying the finding indefinitely.

The update endpoint now removes INTERNAL_ANALYZER finding attributions and component
links when the affected-components list is emptied, and dispatches metrics updates
for the affected components.

Addressed Issue

fixes #7029

Additional Details

• New removeStaleInternalFindings in VulnerabilityQueryManager, invoked from the
  update path inside the existing transaction when the synchronized VulnerableSoftware
  list is empty.
• Regression test included; it fails without the fix (the finding attribution survives
  the update) and passes with it.
• Note: touches the same method as open PR Add opt-in template-based vulnerability ID generation #6639 (adjacent, non-overlapping lines) —
  whichever merges second needs a trivial rebase.

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have updated the migration changelog accordingly
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
• This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

[owasp-dt-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 595 complexity

Metric	Results
Complexity	595

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[heyiamwahab236]

Note on the failing test job: both failures are unrelated, environment-sensitive tests in the existing suite, not caused by this change. First run: GitHubAdvisoryMirrorTaskTest.shouldUseLimitResetHeaderForRetryDelay failed on a timing assertion (retry delay off by 2s) - tracked in #4921. Second run: GitHubMetaAnalyzerTest.testAnalyzerInvalidTag[4] hit its 5-second TimeoutException on the runner. Both classes pass consistently against this branch locally, and the same suite passed on #7104, which is based on the same 4.14.x HEAD. Happy to re-trigger, or a maintainer re-run of the failed job would be appreciated.