The vulnerability feedback factory needs a persisted project even when
just building because of the `pipeline { create(:ci_pipeline, project:
project) }` definition for its pipeline association