Record the source of discovery for internal vulnerabilities

### Current Behavior

Organizations that document their own vulnerabilities (from penetration tests, internal audits, bug bounty reports, vendor advisories, ...) have no way to record where a vulnerability was discovered. The Vulnerability model has no such attribute, and the create/edit forms offer no corresponding field, so teams fall back to encoding this information in the description text where it cannot be displayed or standardized.

### Proposed Behavior

Add an optional, opt-in "Source of Discovery" for INTERNAL vulnerabilities:

- A new optional sourceOfDiscovery attribute on Vulnerability, selectable from an admin-configurable list of sources managed via GET/PUT /v1/customization/vulnerability-source (stored as a standard config property).
- The frontend offers a Source of Discovery dropdown on the create and edit forms and shows the recorded source as a badge on the vulnerability page - only when the feature is enabled by an administrator.
- Off by default; when disabled, nothing changes for existing workflows.

I have a working implementation (backend + frontend) ready to submit as two pull requests.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Start with the Vulnerability model and the GET/PUT /v1/customization/vulnerability-source endpoint, then trace the create and edit forms and the vulnerability page. Confirm how the optional setting affects INTERNAL vulnerabilities and existing workflows; done means the source can be configured, selected, and displayed only when enabled, with the existing implementation coordinated before work begins.

Written by the indexing model from the issue text.