bom-ref, Description, PURL (and maybe also other information) is not taken from BOM

### Current Behavior

I put a BOM to Dependency Track using the REST-API like this (Windows-Curl):
```
curl "http://dockerhost02:8081/api/v1/bom" -H "Content-Type: multipart/form-data" -H "X-API-Key: MYAPIKeY" -F "autoCreate=true" -F "projectName=JustATestClassLibrary" -F "projectVersion=1.0.0" -F "bom=@SBOM\bom-postprocessed.xml" --request POST
```
In general, the Project is created including a vulnerable library (intended), which is also found.

BUT, neither the BOM-REF and PURL nor the DESCRIPTION is taken.
See here:

My CycloneDX-File looks like this:
```

CycloneDX
CycloneDX module for .NET
2.7.0.0



JustATestClassLibrary
1.0.0
pkg:nuget/JustATestClassLibrary@1.0.0
JustATestClassLibrary Description




James Newton-King
Newtonsoft.Json
4.0.1
Json.NET is a popular high-performance JSON framework for .NET
required

C7A076A8455F603C1F216AE85AD4BAF7647C5592D0783BB7D1EF93ADCA03E795AEFB497245255BE15586E84258B268D97E2A8CFCC33732B454C193D0EB002027




pkg:nuget/Newtonsoft.Json@4.0.1


http://james.newtonking.com/projects/json-net.aspx

```

And even the `bom-ref` looks like not to be taken over.
If I do a download of the bom from this project/version I get:
```
{
"bomFormat" : "CycloneDX",
"specVersion" : "1.4",
"serialNumber" : "urn:uuid:66782919-4674-42d2-a13e-ef2f23d5c68f",
"version" : 1,
"metadata" : {
"timestamp" : "2023-01-12T15:08:24Z",
"tools" : [
{
"vendor" : "OWASP",
"name" : "Dependency-Track",
"version" : "4.7.0"
}
],
"component" : {
"name" : "JustATestClassLibrary",
"version" : "1.0.0",
"type" : "library",
"bom-ref" : "9bcfcc86-768a-406f-ba84-55ee28d9a983"
}
},
"components" : [
{
"name" : "Newtonsoft.Json",
"version" : "4.0.1",
"description" : "Json.NET is a popular high-performance JSON framework for .NET",
"hashes" : [
{
"alg" : "SHA-512",
"content" : "c7a076a8455f603c1f216ae85ad4baf7647c5592d0783bb7d1ef93adca03e795aefb497245255be15586e84258b268d97e2a8cfcc33732b454c193d0eb002027"
}
],
"purl" : "pkg:nuget/Newtonsoft.Json@4.0.1",
"externalReferences" : [
{
"type" : "website",
"url" : "http://james.newtonking.com/projects/json-net.aspx"
}
],
"type" : "library",
"bom-ref" : "71b170f5-40e4-48d3-ae3c-93ad455043bd"
}
]
}
```

==> please clarify.

### Steps to Reproduce

See above.

### Expected Behavior

Data is taken over from BOM.

### Dependency-Track Version

4.7.0

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported