empty `blob_path` for security findings

Summary

For both the graphql query getSecurityReportFinding and the rest call /projects/xxx/vulnerability_findings the blobPath/blob_path is empty. For the rest call /merge_requests/xxx/security_reports.json?type=sast the blob_path is not empty.

e.g. for the graphql call

Steps to reproduce

1. go to https://gitlab.com/gitlab-examples/security/security-reports/-/pipelines/1078659009/security
2. click a finding result to load the modal
3. Notice the file path isn't linked
4. check the graphql call

What is the current bug behavior?

blobPath in graphql and blob_path in rest call are empty.

What is the expected correct behavior?

blob_path should contain same value like the rest api ...

This way, we can build the url to the file and make it clickable in the new finding modal.

Relevant logs and/or screenshots

Possible fixes