Update wording and style of vulnerability report empty state messages

What does this MR do?

When viewing the Security Dashboard and Vulnerability Report for a project, group, or instance:

Project	Group	Instance

and they are not configured to show vulnerabilities (defined differently for each level):

Level	How to show the empty state message
Project	The project is empty, has not run at least one pipeline since creation, or does not have security scanners configured
Group	There are no projects in the group
Instance	There are no projects added to the instance under the Settings navbar item

a "not configured" empty state message is shown. This MR does the following:

1. Updates the text. They have gotten a bit out of date.
2. Remove the header if the empty state is shown.
3. Standardize the look and feel across all 3 levels.

Before:

Project	Group	Instance

After:

Project	Group	Instance

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

• 📋 Does this MR need a changelog?
  • I have included a changelog entry.
  • I have not included a changelog entry because _____.
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• [-] Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Related to #287631 (closed)