Integrate vulnerability policy evaluation into scan result processing

[nscuro]

Description

This PR integrates the evaluation and application of vulnerability policies into the vulnerability scan result processing logic. The application includes both analyses and custom ratings, as well as according population of the audit trail.

In order to reduce the performance hit for doing this, the code has been slightly refactored to utilize batched SQL statements wherever possible. The majority of the logic has been migrated to use JDBI instead of DataNucleus, which again results in performance gains due to less ORM overhead.

Addressed Issue

Closes DependencyTrack/hyades#940

Additional Details

• There's quite a bit of code in VulnerabilityScanResultProcessor that could theoretically be moved to separate classes. I left it there for now, as it is kind of specific to what the processor needs. It may not be applicable to other areas of the codebase.
• PROJECT_AUDIT_CHANGE notifications are currently not sent for analyses applied via policy. I added TODOs in the code and raised Send PROJECT_AUDIT_CHANGE notifications for analyses applied via policy hyades#968 to implement that.
• NEW_VULNERABILITY and NEW_VULNERABLE_DEPENDENCY notifications do not currently reflect the rating overwrites applied via policy. I added FIXMEs in the code and raised Rating overrides should reflect in notifications hyades#967 to address that.

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have added corresponding update logic
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[mehab]

lgtm

[mehab]

lgtm