Attributed on date of vulnerability shows a date after suppression/comment date

### Current Behavior

### Steps to Reproduce

1. One of the ways this can be caused is through an SBOM update. The Attributed date is updated but the vulnerability stays the same. I also noticed that new vulnerabilities that are discovered 2 weeks after the SBOM is uploaded will retain the date of the SBOM upload.

### Expected Behavior

The expected behavior would be for the Attributed On field to update when a vulnerability is matched to a component.

### Dependency-Track Version

4.10.x

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start by reproducing the issue with an SBOM update and newly discovered vulnerabilities, then trace the vulnerability-to-component matching and Attributed On update flow. Done means the Attributed On date updates when a vulnerability is matched to a component and does not appear later than the suppression or comment date.

Written by the indexing model from the issue text.