Empty SBOM report returned by ODT

### Current Behavior

Hello,

We upload several SBOM files holding hundreds of dependencies, but when calling ODT API api/v1/bom/cyclonedx/project/XXXX?variant=withVulnerabilities -> we're missing the vulnerabilities structure....And sometimes even the components part and the dependencies is empty :(
Unfortunatelly this behavior is random :(
If at a later time we upload the exactly the same SBOM -> we're getting an SBOM holding all the structures we expect...
So it's not something linked to the uploaded SBOM
We suspect it's more linked to the ODT being under pressure (we're uploading the SBOM files in a batch mode).
Due to performence issues on ODT side...we are deleting the projects once the SBOM holding the vulnerabilities was downloaded...

We were wondering IF it would not be possible to return an error/warning something when ODT detects (I do hope internally it knows that something went wrong) that the report is uncomplete/empty?

For the case when it's missing all the 'mandartory' structures: like components/dependencies + vulnerabilities -> we could try to do something on our end (even if not ideal)
But for the case when we have both components & dependencies and we're only missing the vulnerabilities...there's nothing we could do :( as we cannot know when something went wrong...or if we've found the golden ticket with a project that's vulnerabilities free :)

### Steps to Reproduce

1. upload several SBOM files
2. when api/v1/bom/cyclonedx/project/xxx?variant=withVulnerabilities is called randamly it can return something like
`{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"version": 1,
"serialNumber": "urn:uuid:697bf1aa-f387-4c3e-82ed-29970c77d351",
"metadata":
{
"component":
{
"type": "library",
"name": "leisure/leisure-parent/600376dffeb79835ede4a0b285078036",
"version": "1.0",
"bom-ref": "afef7d9b-0620-43fd-a990-6e0db1abc852"
}
},
"dependencies":
[
{
"dependsOn":
[],
"ref": "afef7d9b-0620-43fd-a990-6e0db1abc852"
}
]
}`

It's not linked to the uploaded SBOM :(
Our batches are running during the night...so I've tried uploading the same SBOM files in the morning everything worked smoothly -> vulnerabilities were detected and the download was ok

### Expected Behavior

We would expect to receive a warning/error something that could indicate that ODT dit not manage to finish it's processing.
I do state that we're calling the api/v1/event/token/XXXX -> to know if the processing is done. We don't try to download an SBOM while this end-point returns true.
We're completely lost as we cannot make a clear distinction between a project with no vulnerabilities and an internal ODT issue

I'm just hoping maybe someone else had a similar issue...maybe you have some leads
Providing an/some SBOMs will not help as it's not SBOM related -> all the ones we tried -> worked perfectly ( we store the uploaded and the dlded SBOMs -> that's why I was able to upload them again)

### Dependency-Track Version

4.12.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported