List repository supply-chain findings

Open findings for the resolved scope. Pull-request and merge-request scans keep no SBOM snapshot, so scoping to one of those jobs with job_id serves the findings from the job’s stored scan result: snapshot is null, and on each finding id, source, first_seen_at, and last_seen_at are null because no stored finding row exists to carry them. For those scopes component_id matches nothing (there are no stored component rows to filter on), and the list is capped at the first 100 findings while finding_count on the summary endpoint still covers the whole set. A change-scan job that ran before scan results were stored returns an empty list.