BOM export from DT has less info than the server has

### Current Behavior

With DT 4.9.0 :

I've seen free-style "properties" and the "pedigree" of components disappear, as discussed earlier (items not of interest to DT so probably not stored into its database after ingress of an SBOM document).

However, I've also had one case with 3 original `externalReference`s in a component, all three displayed as links in DT UI, but when exporting as a downloadable BOM - it populates just two of them.

### Steps to Reproduce

1. Created an SBOM (CycloneDX 1.4) with a custom script to scrape data and merge it into some document by cyclonedx-cli (dotnet). One of the components has several (3) items in the externalReference array, all of them of type "vcs" (links to root of the source repository, to the particular commit hash and to symbolic tag/branch used to produce the SBOM)
2. Uploaded to DT using REST API
3. Clicked into a component, on the top-right there is a drop-down menu for external references: 3 (expected) items are listed; they are also seen in "View Details" pop-up of the component
4. Go to the Project's Components tab, click Download BOM
5. View the received file - for this component it only has two external references.

### Expected Behavior

As long as DT has the information (did not ignore it during import like happens for some other entity types), it should all be present in the BOM export.

### Dependency-Track Version

4.9.0

### Dependency-Track Distribution

Container Image

### Database Server

H2

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported