Move vulnerability statistics update out of transaction

This commit moves the updation of vulnerability statistics
and vulnerability historic statistics out of transaction while
creating a vulnerability in Vulnerabilities::CreateService.

Changelog: performance
EE: true

ee/app/services/vulnerabilities/create_service.rb

@@ -18,13 +18,16 @@ module Vulnerabilities
 
       Vulnerabilities::Finding.transaction(requires_new: true) do # rubocop:disable Performance/ActiveRecordSubtransactions
         save_vulnerability(vulnerability, finding)
-        Statistics::UpdateService.update_for(vulnerability)
-        HistoricalStatistics::UpdateService.update_for(@project)
       rescue ActiveRecord::RecordNotFound
         vulnerability.errors.add(:base, _('finding is not found or is already attached to a vulnerability'))
         raise ActiveRecord::Rollback
       end
 
+      if vulnerability.persisted?
+        Statistics::UpdateService.update_for(vulnerability)
+        HistoricalStatistics::UpdateService.update_for(@project)
+      end
+
       vulnerability
     end
 

ee/spec/services/vulnerabilities/create_service_spec.rb

@@ -93,6 +93,13 @@ RSpec.describe Vulnerabilities::CreateService do
       it 'rejects creation of a new vulnerability from this finding' do
         expect(subject.errors.messages).to eq(expected_error_messages)
       end
+
+      it 'does not update vulnerability statistics' do
+        subject
+
+        expect(Vulnerabilities::HistoricalStatistics::UpdateService).not_to receive(:update_for)
+        expect(Vulnerabilities::Statistics::UpdateService).not_to receive(:update_for)
+      end
     end
 
     context 'when security dashboard feature is disabled' do