Add VULNERABILITY_COMMENT role

### Current Behavior

Currently there is only one Permission VULNERABILITY_ANALYSIS when it comes to handling vulnerabilities.
It includes Commenting out, Supressing and changing Triage status.

### Proposed Behavior

As a big organization we would like to have a separation of duties when it comes to suppressing and setting vulnerabilities as False Positives.
Ideally there would be 2 different roles:
* developer with VULNERABILITY_COMMENT role - who can comment out on the vulnerabilities (with proof why issue is FP or Service Now ticket number)
* security team member with VULNERABILITY_ANALYSIS who would suppress and set those issues as FP's.

Request is to add new role that would not allow developer to change Vulnerability status but to comment out on vulnerabilities.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested