Add spotbugs to analyzer order

Adding spotbugs to ANALYZER_ORDER so that deduplication will prefer
spotbugs over semgrep in the case that there are duplicate findings in a
pipeline.

Changelog: changed

lib/gitlab/ci/reports/security/scanner.rb

@@ -12,6 +12,7 @@ module Gitlab
             "gemnasium-maven" => 3,
             "gemnasium-python" => 3,
             "bandit" => 1,
+            "spotbugs" => 1,
             "semgrep" =>  2
           }.freeze
 

spec/lib/gitlab/ci/reports/security/scanner_spec.rb

@@ -109,6 +109,7 @@ RSpec.describe Gitlab::Ci::Reports::Security::Scanner do
         { external_id: 'gemnasium-maven', name: 'foo', vendor: 'bar' }  | { external_id: 'gemnasium-python', name: 'foo', vendor: 'bar' } | -1
         { external_id: 'gemnasium-python', name: 'foo', vendor: 'bar' } | { external_id: 'bandit', name: 'foo', vendor: 'bar' }           | 1
         { external_id: 'bandit', name: 'foo', vendor: 'bar' }           | { external_id: 'semgrep', name: 'foo', vendor: 'bar' }          | -1
+        { external_id: 'spotbugs', name: 'foo', vendor: 'bar' }         | { external_id: 'semgrep', name: 'foo', vendor: 'bar' }          | -1
         { external_id: 'semgrep', name: 'foo', vendor: 'bar' }          | { external_id: 'unknown', name: 'foo', vendor: 'bar' }          | -1
         { external_id: 'gemnasium', name: 'foo', vendor: 'bar' }        | { external_id: 'gemnasium', name: 'foo', vendor: nil }          | 1
       end