Golang indirect module misreported vulnerabilities

### Current Behavior

I have a golang image with an indirect dependency on a particular package - here is it's sbom extract:

` {
"name" : "github.com/json-iterator/go",
"version" : "v1.1.12",
"hashes" : [
{
"alg" : "SHA-256",
"content" : "3d5f29788e1ad32b27733ae0f8bb71ca40fc2df298f4c2fabb68e7c5a127ae73"
}
],
"purl" : "pkg:golang/github.com/json-iterator/go@v1.1.12",
"type" : "library",
"bom-ref" : "c9ef77b2-4b76-41f9-ad1c-2a7a9b6c32d8"
},`

It is showing as having many critical vulnerabilities, two examples being CVE-2015-5739 and CVE-2015-5740 - they all relate to old versions of golang. My conclusion from this is that DT is acting on the 'go@v1.1.12' at the end of the purl and showing vulnerabilities for that version of golang, which have nothing to do with the json-iterator package itself

### Steps to Reproduce

1. This is a sample sbom with the affected package, please try uploading it to DT: `{
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"serialNumber": "urn:uuid:d33bab03-e756-4f6e-a362-e5263b5a8771",
"version": 1,
"metadata": {
"timestamp": "2023-06-21T09:05:31+00:00",
"tools": [
{
"vendor": "aquasecurity",
"name": "trivy",
"version": "0.42.1"
}
],
"component": {
"bom-ref": "2d8243b1-9418-4db1-9d80-1219512d7367",
"type": "application",
"name": ".",
"properties": [
{
"name": "aquasecurity:trivy:SchemaVersion",
"value": "2"
}
]
}
},
"components": [
{
"bom-ref": "7526f234-152a-4bf7-8148-3e91651b5a9d",
"type": "application",
"name": "go.mod",
"properties": [
{
"name": "aquasecurity:trivy:Class",
"value": "lang-pkgs"
},
{
"name": "aquasecurity:trivy:Type",
"value": "gomod"
}
]
},
{
"bom-ref": "pkg:golang/github.com/json-iterator/go@1.1.12",
"type": "library",
"name": "github.com/json-iterator/go",
"version": "1.1.12",
"licenses": [
{
"expression": "MIT"
}
],
"purl": "pkg:golang/github.com/json-iterator/go@1.1.12",
"properties": [
{
"name": "aquasecurity:trivy:PkgID",
"value": "github.com/json-iterator/go@v1.1.12"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "gomod"
}
]
},
{
"bom-ref": "pkg:golang/github.com/modern-go/concurrent@0.0.0-20180228061459-e0a39a4cb421",
"type": "library",
"name": "github.com/modern-go/concurrent",
"version": "0.0.0-20180228061459-e0a39a4cb421",
"licenses": [
{
"expression": "Apache-2.0"
}
],
"purl": "pkg:golang/github.com/modern-go/concurrent@0.0.0-20180228061459-e0a39a4cb421",
"properties": [
{
"name": "aquasecurity:trivy:PkgID",
"value": "github.com/modern-go/concurrent@v0.0.0-20180228061459-e0a39a4cb421"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "gomod"
}
]
},
{
"bom-ref": "pkg:golang/github.com/modern-go/reflect2@1.0.2",
"type": "library",
"name": "github.com/modern-go/reflect2",
"version": "1.0.2",
"licenses": [
{
"expression": "Apache-2.0"
}
],
"purl": "pkg:golang/github.com/modern-go/reflect2@1.0.2",
"properties": [
{
"name": "aquasecurity:trivy:PkgID",
"value": "github.com/modern-go/reflect2@v1.0.2"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "gomod"
}
]
}
],
"dependencies": [
{
"ref": "2d8243b1-9418-4db1-9d80-1219512d7367",
"dependsOn": [
"7526f234-152a-4bf7-8148-3e91651b5a9d"
]
},
{
"ref": "7526f234-152a-4bf7-8148-3e91651b5a9d",
"dependsOn": [
"pkg:golang/github.com/json-iterator/go@1.1.12"
]
},
{
"ref": "pkg:golang/github.com/json-iterator/go@1.1.12",
"dependsOn": [
"pkg:golang/github.com/modern-go/concurrent@0.0.0-20180228061459-e0a39a4cb421",
"pkg:golang/github.com/modern-go/reflect2@1.0.2"
]
},
{
"ref": "pkg:golang/github.com/modern-go/concurrent@0.0.0-20180228061459-e0a39a4cb421",
"dependsOn": []
},
{
"ref": "pkg:golang/github.com/modern-go/reflect2@1.0.2",
"dependsOn": []
}
],
"vulnerabilities": []
}
`

### Expected Behavior

I don't believe there are any current vulnerabilities for json-iterator/go

### Dependency-Track Version

4.8.2

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported