Don't auto-resolve dismissed vulnerabilities

If the vulnerability is dismissed, the auto-resolve policy will
transition it to resolved. This is not intended as dismissed
vulnerabilities should stay dismissed. This change updates the
auto-resolve service to exclude dismissed vulnerabilities.

Changelog: fixed
EE: true