External References are removed when uploading SBOM (from both UI and/or API)

### Current Behavior

External References are removed from the project when sbom is uploaded to that project. The external references are removed no matter if one uploads the sbom through UI or with API.

When uploading the sbom by calling the API, I am calling the `/v1/bom` endpoint with `PUT` so I am surprised that it edits the properties of the project itself.

### Steps to Reproduce

1. Create a project in Dependency Track
2. Add external references by calling the API endpoint with `PATCH` `/v1/project/{uuid}`. Add the external references in the payload e.g.
```
"externalReferences": [
{
"type": "vcs",
"url": "",
"comment": ""
}
```
3. Verify the external references by visiting _project -> view details -> external references_
4. Upload SBOM (UI) _project -> components -> Upload BOM_
5. Confirm that external references are removed by visiting again _project -> view details -> external references_

### Expected Behavior

The external references persist when SBOM is uploaded.

### Dependency-Track Version

4.12.6

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported