Enable security report downloads by default

This enables by default the feature added in
https://gitlab.com/gitlab-org/gitlab/-/issues/249544.

Addresses https://gitlab.com/gitlab-org/gitlab/-/issues/273418, part of
https://gitlab.com/groups/gitlab-org/-/epics/4394.

app/controllers/projects/merge_requests_controller.rb

@@ -40,7 +40,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
     push_frontend_feature_flag(:default_merge_ref_for_diffs, @project)
     push_frontend_feature_flag(:core_security_mr_widget, @project, default_enabled: true)
     push_frontend_feature_flag(:core_security_mr_widget_counts, @project)
-    push_frontend_feature_flag(:core_security_mr_widget_downloads, @project)
+    push_frontend_feature_flag(:core_security_mr_widget_downloads, @project, default_enabled: true)
     push_frontend_feature_flag(:remove_resolve_note, @project, default_enabled: true)
     push_frontend_feature_flag(:test_failure_history, @project)
     push_frontend_feature_flag(:diffs_gradual_load, @project)

changelogs/unreleased/273418-enable-security-report-downloads.yml

+---
+title: Allow downloading of security reports directly from merge request page
+merge_request: 49572
+author:
+type: added

config/feature_flags/development/core_security_mr_widget_downloads.yml

@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/273418
 milestone: '13.7'
 type: development
 group: group::static analysis
-default_enabled: false
+default_enabled: true

doc/user/application_security/index.md

@@ -127,6 +127,7 @@ with this approach, however, and there is a
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/4393) in GitLab Core 13.5.
 > - Made [available in all tiers](https://gitlab.com/gitlab-org/gitlab/-/issues/273205) in 13.6.
+> - Report download dropdown [added](https://gitlab.com/gitlab-org/gitlab/-/issues/273418) in 13.7.
 > - It's [deployed behind a feature flag](../feature_flags.md), enabled by default.
 > - It's enabled on GitLab.com.
 > - It can be enabled or disabled for a single project.
@@ -137,9 +138,10 @@ WARNING:
 This feature might not be available to you. Check the **version history** note above for details.
 
 Merge requests which have run security scans let you know that the generated
-reports are available to download.
+reports are available to download. To download a report, click on the
+**Download results** dropdown, and select the desired report.
 
-![Security widget](img/security_widget_v13_6.png)
+![Security widget](img/security_widget_v13_7.png)
 
 ## Interacting with the vulnerabilities