0 Vulnerabilities not detected in imported SBOM with vulnerabilities

### Current Behavior

I created a new project and imported an SBOM of an old version of debian-slim. Trivy reports vulnerabilities but dependencyTrack doesn't. I created a Sonatype OSS account and configured but that did not change the result.

Trivy:

```
└─(11:13:45)──> trivy image debian:stable-20230202 ──(Thu,Aug03)─┘
2023-08-03T11:23:28.203+0200 INFO Vulnerability scanning is enabled
2023-08-03T11:23:28.203+0200 INFO Secret scanning is enabled
2023-08-03T11:23:28.203+0200 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-08-03T11:23:28.203+0200 INFO Please see also https://aquasecurity.github.io/trivy/v0.43/docs/scanner/secret/#recommendation for faster secret detection
2023-08-03T11:23:34.212+0200 INFO Detected OS: debian
2023-08-03T11:23:34.212+0200 INFO Detecting Debian vulnerabilities...
2023-08-03T11:23:34.235+0200 INFO Number of language-specific files: 0

debian:stable-20230202 (debian 11.6)

Total: 99 (UNKNOWN: 0, LOW: 66, MEDIUM: 10, HIGH: 22, CRITICAL: 1)
```

DependencyTrack:


### Steps to Reproduce

1. Create SBOM using trivy

```
trivy image debian:stable-20230202 --format cyclonedx --output ~/win_tmp/result-debian.cdx
```

2. Install DependencyTrack following the regular installation instructions

```
curl -LO https://dependencytrack.org/docker-compose.yml
docker-compose up
```

3. Configure Sonatype OSS credentials

4. Import SBOM generated in step 1

### Expected Behavior

Vulnerabilities reported.

### Dependency-Track Version

4.8.2

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported