Only GHSA ID returned for vulnerability having an NVD ID

### Current Behavior

Hello,

We have NVD + GHSA configured as vulnerability sources within our ODT instance.
Since we activated the GHSA we were used to get most of vulnerabilities twice (once with the NVD id like CVE-2016-1000027 and once again with the GHSA id: GHSA-4wrc-f8pq-fpqp)... We were not thrilled...but we made our peace with it...and adapted our code to make sure no duplicates were returned to the end user...
But yesterday we noticed that for some projects we get only t he GHSA ID -> which kind of breaks our logic :(

We get the same behavior when calling the API: v1/bom/cyclonedx/project/xxxxx?variant=withVulnerabilities
When calling the endpoint: api/v1/vulnerability/project/xxxxx we do get both IDs (CVE + GHSA):
{
"cveId": "CVE-2016-1000027",
"ghsaId": "GHSA-4wrc-f8pq-fpqp",
"uuid": "44666f26-b8dd-4a0f-a36a-7a07e4e27aa8"
}

We have the same behaviour with 2 different versions of ODT:
Dependency-Trac v4.12.0
Dependency-Track v4.11.7

Thank you very much for your help!
Andreea

### Steps to Reproduce

1. upload an SBOM holding a Spring 5.3.40 (or lower):
"publisher": "Spring IO",
"group": "org.springframework",
"name": "spring-core",
"version": "5.3.40",
"description": "Spring Core",

When ODT finished its analysis -> we end up with only :GHSA-4wrc-f8pq-fpqp
We don't get CVE-2016-1000027

### Expected Behavior

as both sources (NVD +GHSA) are configured -> we expected to have both IDs returned.
In this case GHSA-4wrc-f8pq-fpqp and CVE-2016-1000027

### Dependency-Track Version

4.12.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported