internal/frontend: gate vuln pages by experiment

If the "vulns" experiment is not active, don't try to show pages under
/vuln.

Change-Id: Id54e83be49f2ee8196223f9c1928473436f464df
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/366055
Trust: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Jonathan Amsterdam <jba@google.com>
Reviewed-by: Jamal Carvalho <jamal@golang.org>
diff --git a/internal/frontend/vulns.go b/internal/frontend/vulns.go
index 4552520..a7f3fb1 100644
--- a/internal/frontend/vulns.go
+++ b/internal/frontend/vulns.go
@@ -11,6 +11,7 @@
 	"golang.org/x/mod/semver"
 	"golang.org/x/pkgsite/internal"
 	"golang.org/x/pkgsite/internal/derrors"
+	"golang.org/x/pkgsite/internal/experiment"
 	"golang.org/x/sync/errgroup"
 	vulnc "golang.org/x/vuln/client"
 	"golang.org/x/vuln/osv"
@@ -102,6 +103,9 @@
 }
 
 func (s *Server) serveVuln(w http.ResponseWriter, r *http.Request, _ internal.DataSource) error {
+	if !experiment.IsActive(r.Context(), internal.ExperimentVulns) {
+		return &serverError{status: http.StatusNotFound}
+	}
 	switch r.URL.Path {
 	case "/":
 		s.servePage(r.Context(), w, "vuln", s.newBasePage(r, "Go Vulnerabilities"))
@@ -109,7 +113,7 @@
 		// Serve a list of all entries.
 		vulnListPage, err := newVulnListPage(s.vulnClient)
 		if err != nil {
-			return err
+			return &serverError{status: derrors.ToStatus(err)}
 		}
 		vulnListPage.basePage = s.newBasePage(r, "Go Vulnerabilities List")
 		s.servePage(r.Context(), w, "vuln/list", vulnListPage)
@@ -117,7 +121,7 @@
 		id := r.URL.Path[1:]
 		vulnPage, err := newVulnPage(s.vulnClient, id)
 		if err != nil {
-			return err
+			return &serverError{status: derrors.ToStatus(err)}
 		}
 		vulnPage.basePage = s.newBasePage(r, id)
 		s.servePage(r.Context(), w, "vuln/entry", vulnPage)