Cover metadata parsing for json upgrade

Adds specs and a new condition to cover non-hash JSON in the
metadata attribute.

ee/app/models/vulnerabilities/occurrence.rb

@@ -228,7 +228,11 @@ module Vulnerabilities
 
     def metadata
       strong_memoize(:metadata) do
-        Gitlab::Json.parse(raw_metadata)
+        data = Gitlab::Json.parse(raw_metadata)
+
+        data = {} unless data.is_a?(Hash)
+
+        data
       rescue JSON::ParserError
         {}
       end

ee/spec/models/vulnerabilities/occurrence_spec.rb

@@ -606,4 +606,28 @@ describe Vulnerabilities::Occurrence do
 
     it { is_expected.to eql(expected_cve) }
   end
+
+  describe "#metadata" do
+    let(:occurrence) { build(:vulnerabilities_occurrence) }
+
+    subject { occurrence.metadata }
+
+    it "handles bool JSON data" do
+      allow(occurrence).to receive(:raw_metadata) { "true" }
+
+      expect(subject).to eq({})
+    end
+
+    it "handles string JSON data" do
+      allow(occurrence).to receive(:raw_metadata) { '"test"' }
+
+      expect(subject).to eq({})
+    end
+
+    it "parses JSON data" do
+      allow(occurrence).to receive(:raw_metadata) { '{ "test": true }' }
+
+      expect(subject).to eq({ "test" => true })
+    end
+  end
 end