DT does not list Vulnerabilities for bundled plugins

### Current Behavior

Hello, I seem to have stumbled upon something which i am not sure is an expected behaviour or maybe my misunderstanding . I have tried to put everything together here.

We are using cycloneDx to create SBOM for our multi module maven project and Dependency track to visualise them. However it seems to show some strange results.
This is a jira project(complex structure) which is the parent project and has a number of modules(each having it’s own pom.xml), third party dependencies etc. One of these are our bundled plugins which is accessed from the internal repository of jira.

When I upload BOM of jira parent pom.xml, I find that the components of bundled plugin show zero vulnerabilities whereas when I upload BOM of a particular plugin project(in our case mobile-rest), it clearly shows that some vulnerabilities do exist. However for some reason this is not captured when the parent project is used.

Essentially, When I generate sbom for the child project separately as a standalone project and upload it to dependency track, I can see a list of dependencies and the subsequent vulnerabilities associated with it. However when I generate sbom on the parent project which includes this child project as a multi module maven project, I notice that it shows empty list of dependencies for the child project within the parent project. Could it be an issue with the sbom or dependency track?

Is this expected? How can I fix this?

P.S. I have tried using dependency-check on bundled plugins and it seems to show the vulnerabilities however sbom created under bundled plugins doesn’t seem to work when using Dependency track.

Am i missing some configuration here or is this an expected behaviour?

Here is a screenshot of the Parent project with the bundled plugin component showing zero vulnerabilities

Here you can see that when I have created a separate project namely mobile-rest-parent , it reflects the vulnerabilities

### Steps to Reproduce

1. Use cycloneDx to generate SBOM for parent module
2. Auto upload to DT using DT maven plugin
3. No Vulnerabilities listed for the bundled plugin component - mobile-rest
4. Generate SBOm separately for mobile-rest
5. Auto upload to DT using DT maven plugin
6. A list of vulnerabilities is visible when done individually

### Expected Behavior

Expected : For multi module maven project, DT should show vulnerabilities listed under the components

### Dependency-Track Version

4.7.x

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported