Refactor vulnerability scanner specs

* Assert empty report when data is not sufficient
* Assert findings are created as expected
* Assert that scanner is added
* Assert that report links to pipeline of SBoM
* Assert correct location of findings