Alert NEW_VULNERABILITY alerts in two ways

### Current Behavior:

With an email PORTFOLIO alert configured for "Notify On" NEW_VULNERABILITY only, there are two types of emails received

* New Vulnerability Identified
* Vulnerable Dependency Introduced

This seems over-broad... I would expect to receive only the 1st of these.

This will be important when I configure slack notifications, as it would be "New Vulnerability Identified" that would be the heads-up that there is a need to triage something that is new to the organisation.

### Steps to Reproduce:

1. Configure Dependency-Track with a single alert, of type PORTFOLIO and specifying NEW_VULNERABILITY.

2. Create a project and upload a BOM that contains a component with a vulnerability that is "brand new" (never previously seen by the server).

3. Check the received email alert/s for content.

### Expected Behavior:
As above, I would expect to not see "Vulnerable Dependency Introduced" alerts for this configuration.

### Environment:

- Dependency-Track Version: 3.5.0
- Distribution: [Executable WAR]
- BOM Format & Version: CycloneDX 1.1
- Database Server: [ PostgreSQL ]