Dependency Track not resolving the CVE Severity

### Current Behavior

We have recently performed SBOM analysis and Dependency Track is not assigning the severity for many CVEs, even though the OSSIndex has it assigned.

Example.. (many more if you need them)

Purl = pkg:maven/org.apache.avro/avro@1.11.3
Link to OSSIndex = https://ossindex.sonatype.org/vulnerability/CVE-2024-47561?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=dependency-track&utm_medium=integration&utm_content=v4.11.5

### Steps to Reproduce

1.Create new DT project
2. Add component 'pkg:maven/org.apache.avro/avro@1.11.3'
3. See DT resolve with CVE, but not assign severity
4. Link to OSSIndex = https://ossindex.sonatype.org/vulnerability/CVE-2024-47561?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=dependency-track&utm_medium=integration&utm_content=v4.11.5

### Expected Behavior

Resolve severity

### Dependency-Track Version

4.11.x

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported