perf(finding): add sla_expiration_date index for global finding list (DefectDojo#15103)

The global finding list ordered by sla_expiration_date seq-scanned and
sorted the entire authorized finding set on every page load. Add a full
(non-partial) btree on sla_expiration_date so the planner can walk the
index and stop at the LIMIT instead.

The existing partial idx_finding_sla_open_cov cannot serve this query
because the query has no is_mitigated predicate.

Measured on a 10M-finding clone, global finding list ORDER BY
sla_expiration_date ASC LIMIT 25 (per-user authorization filter), under
load test:

- Before: mean 6591 ms, max 20732 ms, total 1582 s
- After:  mean  115 ms, max  4992 ms, total   96 s

(~57x mean improvement; the query dropped from the #1 offender to
negligible). Index size ~68 MB on the clone. Built CONCURRENTLY
(atomic = False) so the migration takes no ACCESS EXCLUSIVE lock on the
large dojo_finding table.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>

Author: 3 people

dojo/db_migrations/0274_finding_sla_expiration_index.py

@@ -0,0 +1,27 @@
+from django.contrib.postgres.operations import AddIndexConcurrently
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    # CREATE INDEX CONCURRENTLY cannot run inside a transaction block, and avoids
+    # an ACCESS EXCLUSIVE lock on the (large) dojo_finding table.
+    atomic = False
+
+    dependencies = [
+        ("dojo", "0273_product_upper_name_index"),
+    ]
+
+    operations = [
+        # Full (non-partial) btree on sla_expiration_date. The global finding
+        # list ordered by sla_expiration_date currently seq-scans + sorts the
+        # entire authorized finding set; this lets the planner walk the index and
+        # stop at the LIMIT. The existing partial idx_finding_sla_open_cov cannot
+        # serve it because that query has no is_mitigated predicate.
+        AddIndexConcurrently(
+            model_name="finding",
+            index=models.Index(
+                fields=["sla_expiration_date"],
+                name="idx_finding_sla_exp",
+            ),
+        ),
+    ]

dojo/finding/models.py

@@ -511,6 +511,15 @@ class Meta:
                 include=["id"],
                 condition=models.Q(is_mitigated=False),
             ),
+            # Full (non-partial) index so the global finding list ordered by
+            # sla_expiration_date can be served by an index walk + LIMIT instead
+            # of sorting the entire authorized finding set. The partial
+            # idx_finding_sla_open_cov can't serve it (query has no is_mitigated
+            # filter).
+            models.Index(
+                fields=["sla_expiration_date"],
+                name="idx_finding_sla_exp",
+            ),
         ]
 
     def __init__(self, *args, **kwargs):