fix: Fix Swagger UI rendering of CVSS4 nested schema fields

[mtruj013]

Done

• Fixed cvs4 fields not showing up on swagger docs

QA

• Check out this feature branch
• Run the site using the command docker compose up -d then dotrun
• View the site locally in your web browser at: http://0.0.0.0:8030/security/api/docs#/default/get_security_cves_json
• See that the csv4 fields are documented

Issue / Card

Fixes https://warthogs.atlassian.net/browse/WD-37123

Screenshots

[Skazitron]

@mtruj013 Thanks for the fix. Is there a way to achieve the same outcome without making those CVSS4 fields mandatory?

[mtruj013]

@Skazitron removing allow_none=true doesn't make the fields mandatory, that's done with the required parameter. allow_none only controls whether an explicit null is valid, it defaults to false, meaning null would now be rejected if passed. I confirmed with the sec team that they do not pass these as null but rather just omit them so this parameter is not needed

[Skazitron]

@mtruj013 got it. LGTM then.

[mtruj013]

Dealing with really long/hanging jenkins builds. Fixing that before merging this as it is not super high priority

[Copilot]

Pull request overview

This PR adjusts the Marshmallow schema definitions for CVSS v4 objects so that Swagger UI correctly renders nested schema fields in the generated OpenAPI/Swagger documentation for the Security API.

Changes:

• Removed allow_none=True from several CVSS v4 Nested(...) fields to improve Swagger UI rendering of nested properties.
• Updated CVSS v4 base/modified/environmental/threat metric schema nesting to be non-nullable in the spec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.