Fix wrong message for group vulnerability report

What does this MR do?

When a group has projects but none of the projects have vulnerabilities, either because they're not configured with a vulnerability job, or because a pipeline hasn't been run against the project, or a vulnerability job was run and no vulnerabilities were found:

the displayed message informs the user to add projects to their group, which is incorrect. This MR fixes it by displaying the correct "no vulnerabilities found" message:

Before	After

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• [-] Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• [-] Style guides
• [-] Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Related to #287631 (closed)