fix(scan): dump nil slice of vulnerabilities as empty slice in report

Closes #11131

Signed-off-by: He Weiwei <hweiwei@vmware.com>

src/pkg/scan/vuln/report.go

@@ -15,6 +15,8 @@
 package vuln
 
 import (
+	"encoding/json"
+
 	v1 "github.com/goharbor/harbor/src/pkg/scan/rest/v1"
 )
 
@@ -30,6 +32,24 @@ type Report struct {
 	Vulnerabilities []*VulnerabilityItem `json:"vulnerabilities"`
 }
 
+// MarshalJSON custom function to dump nil slice of Vulnerabilities as empty slice
+// See https://github.com/goharbor/harbor/issues/11131 to get more details
+func (report *Report) MarshalJSON() ([]byte, error) {
+	type Alias Report
+
+	aux := &struct {
+		*Alias
+	}{
+		Alias: (*Alias)(report),
+	}
+
+	if aux.Vulnerabilities == nil {
+		aux.Vulnerabilities = []*VulnerabilityItem{}
+	}
+
+	return json.Marshal(aux)
+}
+
 // Merge ...
 func (report *Report) Merge(another *Report) *Report {
 	generatedAt := report.GeneratedAt