Add malicious package test for vllm

[rdimitrov]

The following PR adds malicious package test for vllm.

Related to: #904

hey, let's not merge it yet, it doesn't seem stable enough

[rdimitrov]

I had to update the malicious package test case for this and the rest of the local providers because of the capabilities of the 0.5B model we are using for these tests. It looks like it cannot handle the system prompts as precisely as we expect which results in non-deterministic responses, i.e. sometimes it includes example code snippets even though it says the package is malicious, sometimes it doesn't include the link to insights. To handle all of this decided to simplify the test and just check if CodeGate was able to flag it.

[jhrozek]

the functionality is shared across the providers, so I think this is good enough