fix(finding): run Finding.delete() for each finding the merge action deletes

[svader0]

Description

The "delete" option on Merge Findings called .delete() on the queryset. That skips Finding.delete(), so the merge skipped the duplicate-cluster handling, the JIRA sync, the ordered tag removal and the product grading. If a deleted finding was the original of a duplicate cluster, its duplicates kept pointing at a row that no longer existed.

This PR deletes each finding with Finding.delete(), the same way the bulk delete route does.

Behavior change for users who can already delete: a merge with "delete" now re-grades the product and runs the normal JIRA sync for each deleted finding.

Test results

• New test test_merge_delete_promotes_a_new_original_for_the_duplicate_cluster in unittests/test_bulk_finding_authorization.py. It makes the deleted finding the original of a duplicate, then checks that the duplicate becomes the new original. It fails before the fix and passes after it.
• unittests.test_bulk_finding_authorization, unittests.test_merge_findings_locations and unittests.test_finding_template_merge_endpoints_v3: 17 tests, all pass.
• ruff check . with ruff 0.16.9: all checks pass.

Documentation

No documentation change. The merge form and its options do not change.

Checklist

• Make sure to rebase your PR against the very latest dev.
• Submit all PRs, features and bug fixes alike, against the dev branch.
• Give a meaningful name to your PR, as it may end up being used in the release notes.
• Your code is Ruff compliant (see ruff.toml).
• Your code is python 3.13 compliant.
• If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
• Model changes must include the necessary migrations in the dojo/db_migrations folder.
• Add applicable tests to the unit tests.
• Add the proper label to categorize your PR.

[svader0]

[sc-15583]