fix: populate packageName and vulnerabilityName in activity stream events

[gauravshinde1729]

Summary

Fixes #1818 — the activity stream was showing "System detected a vulnerability in ?" for all detected events instead of the actual
CVE name and package name.

Root Cause

ReadEventsByAssetIDAndAssetVersionName in the controller was calling
transformer.ConvertVulnEventToDto(ved.VulnEvent) which takes the base
VulnEvent model and has no access to the joined fields (component_purl,
cve_id) that the repository query already fetches via LEFT JOINs.

Changes

• transformer/vulnevent_transformer.go — added ConvertVulnEventDetailToDto
  which maps all joined fields including VulnerabilityName (from CVEID),
  PackageName (from ComponentPurl) and URI. Refactored
  ConvertVulnEventsToDtos to delegate to it.
• controllers/vuln_event_controller.go — replaced
  ConvertVulnEventToDto(ved.VulnEvent) with ConvertVulnEventDetailToDto(ved)
  so joined fields are no longer discarded.
• controllers/vuln_event_controller_test.go — added tests for
  ReadEventsByAssetIDAndAssetVersionName covering the 500 error path and
  verifying packageName and vulnerabilityName are correctly populated in
  the response.

Testing

• Unit tests: go test ./controllers/ -run TestReadEventsByAssetIDAndAssetVersionName -v

Output: