No archived or deleted project vulnerabilties

When fetching all the vulnerabilities in a group, don't include
vulnerabilities from archived or deleted projects. This matches how
archived and deleted projects are treated elsewhere in the code.

https://gitlab.com/gitlab-org/gitlab/-/issues/207438

ee/app/models/ee/group.rb

@@ -306,7 +306,9 @@ module EE
     end
 
     def vulnerabilities
-      ::Vulnerability.where(project: ::Project.for_group_and_its_subgroups(self))
+      ::Vulnerability.where(
+        project: ::Project.for_group_and_its_subgroups(self).non_archived.without_deleted
+      )
     end
 
     private

ee/spec/models/group_spec.rb

@@ -258,15 +258,19 @@ describe Group do
   end
 
   describe '#vulnerabilities' do
+    subject { group.vulnerabilities }
+
     let(:subgroup) { create(:group, parent: group) }
     let(:group_project) { create(:project, namespace: group) }
     let(:subgroup_project) { create(:project, namespace: subgroup) }
+    let(:archived_project) { create(:project, :archived, namespace: group) }
+    let(:deleted_project) { create(:project, pending_delete: true, namespace: group) }
     let!(:group_vulnerability) { create(:vulnerability, project: group_project) }
     let!(:subgroup_vulnerability) { create(:vulnerability, project: subgroup_project) }
+    let!(:archived_vulnerability) { create(:vulnerability, project: archived_project) }
+    let!(:deleted_vulnerability) { create(:vulnerability, project: deleted_project) }
 
-    subject { group.vulnerabilities }
-
-    it 'returns vulnerabilities for all projects in the group and its subgroups' do
+    it 'returns vulnerabilities for all non-archived, non-deleted projects in the group and its subgroups' do
       is_expected.to contain_exactly(group_vulnerability, subgroup_vulnerability)
     end
   end