Pull dismissal data from feedback for pre-SAV

Vulnerabilities will pull the `dismissed_by_id` from
`dismissal_feedback` if the value is not found for
the vulnerability.

ee/app/models/vulnerability.rb

@@ -96,6 +96,10 @@ class Vulnerability < ApplicationRecord
     findings.first
   end
 
+  def dismissed_by_id
+    super || finding&.dismissal_feedback.try(:author_id)
+  end
+
   delegate :scanner_name, :metadata, :message, :cve,
            to: :finding, prefix: true, allow_nil: true
 

ee/changelogs/unreleased/217600-vulnerability-feedback-is-missing-for-vulnerability-occurrences.yml

+---
+title: Fix missing dismissed_by field
+merge_request: 32147
+author:
+type: fixed

ee/spec/models/vulnerability_spec.rb

@@ -303,4 +303,43 @@ describe Vulnerability do
       )
     end
   end
+
+  describe '#dismissed_by_id' do
+    let_it_be(:user_1) { create(:user) }
+    let_it_be(:user_2) { create(:user) }
+    let_it_be(:project) { create(:project) }
+    let_it_be(:occurrence) do
+      create(
+        :vulnerabilities_occurrence,
+        report_type: :dependency_scanning,
+        project: project
+      )
+    end
+    let_it_be(:dismissal_feedback) do
+      create(
+        :vulnerability_feedback,
+        :dependency_scanning,
+        :dismissal,
+        project: project,
+        project_fingerprint: occurrence.project_fingerprint,
+        author: user_1
+      )
+    end
+
+    let(:vulnerability) { create(:vulnerability, findings: [occurrence]) }
+
+    subject { vulnerability.dismissed_by_id }
+
+    context 'when the `dismissed_by_id` exists' do
+      before do
+        vulnerability.update_attribute(:dismissed_by_id, user_2.id)
+      end
+
+      it { is_expected.to eq(user_2.id) }
+    end
+
+    context 'when the `dismissed_by_id` does not exist' do
+      it { is_expected.to eq(user_1.id) }
+    end
+  end
 end