Vulnerabilities in ubuntu docker image not found

### Current Behavior

We are using dependencytrack for half a year and we recently noticed, that sometime vulns in docker images are not detected. I have tested this behavoir with the latest ubuntu:24.04 image, which should contain at least some medium issues (according to a trivy scan with the same image):


We are using the internal analyzer with the NVD Database (see screenshot attached)


### Steps to Reproduce

1. Generate an sbom file from ubuntu: `trivy image --format cyclonedx --output ubuntu-24.04.json ubuntu:24.04`
2. Create a new project via UI, go to the "compontens" tab and upload the json file via "upload SBOM" (See my uploaded sbom file: [ubuntu-24.04.json](https://github.com/user-attachments/files/19792463/ubuntu-24.04.json))
3. Reload the page, go to the "vulnerabilities" tab and click "Reanalyze"

These are the logs, when clicking reanalyze:

```
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,174 INFO [FindingResource] Analysis of project ec4a6efe-9d37-459b-ba4e-1c27a02230e3 requested by benjamin.meichsner@aboutsource.net [principal=benjamin.meichsner@aboutsource.net, requestUri=/v1/finding/project/{uuid}/analyze, requestId=988caa9e-25fa-4dc4-9d23-00a40adeb25c, requestMethod=POST]
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,325 INFO [InternalAnalysisTask] Starting internal analysis task [eventToken=a6b84b98-a83b-464e-87f0-8753c0418465, projectName=ubuntu-24.04-test, vulnAnalysisLevel=ON_DEMAND, projectUuid=ec4a6efe-9d37-459b-ba4e-1c27a02230e3, projectVersion=null]
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,325 INFO [InternalAnalysisTask] Analyzing 92 component(s) [eventToken=a6b84b98-a83b-464e-87f0-8753c0418465, projectName=ubuntu-24.04-test, vulnAnalysisLevel=ON_DEMAND, projectUuid=ec4a6efe-9d37-459b-ba4e-1c27a02230e3, projectVersion=null]
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,443 INFO [InternalAnalysisTask] Internal analysis complete [eventToken=a6b84b98-a83b-464e-87f0-8753c0418465, projectName=ubuntu-24.04-test, vulnAnalysisLevel=ON_DEMAND, projectUuid=ec4a6efe-9d37-459b-ba4e-1c27a02230e3, projectVersion=null]
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,446 INFO [PolicyEngine] Evaluating 93 component(s) against applicable policies [eventToken=a6b84b98-a83b-464e-87f0-8753c0418465, projectName=ubuntu-24.04-test, projectUuid=ec4a6efe-9d37-459b-ba4e-1c27a02230e3, projectVersion=null]
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,447 INFO [RepositoryMetaAnalyzerTask] Performing component repository metadata analysis against 93 components
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,490 INFO [RepositoryMetaAnalyzerTask] Completed component repository metadata analysis against 93 components
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,720 INFO [PolicyEngine] Policy analysis complete [eventToken=a6b84b98-a83b-464e-87f0-8753c0418465, projectName=ubuntu-24.04-test, projectUuid=ec4a6efe-9d37-459b-ba4e-1c27a02230e3, projectVersion=null]
Apr 17 09:56:25 dependencytrack-staging-00 598df2ae194a[945]: 2025-04-17 09:56:25,720 INFO [ProjectMetricsUpdateTask] Executing metrics update for project ec4a6efe-9d37-459b-ba4e-1c27a02230e3
```

### Expected Behavior

I would expect, that dependecy track would at least find some vulns like trivy:


I also checked, that the CVE-2024-56406 can be found in dependencytrack.

### Dependency-Track Version

4.13.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported