Reenable passing target_branch

What does this MR do and why?

Reenable passing target_branch

This change reenables passing the target_branch to MergeRequests::CreateFromVulnerabilityDataService.

This was believed to be unecessary and was removed in a394264f but is still required when creating MRs from vulnerabilities with a target branch that is not the project default.

Specifically this occurs when creating a remediation MR from a security finding on an existing MR. In this case the target_branch is passed from the front end to Projects::VulnerabilityFeedbackController#create and bubbles up from there to these services.

Additionally create_from_vulnerability_data_service_spec.rb has been moved to the correct folder.

Related to #419876 (closed)