False negatives of vulnerabilities due to versioning of certain PHP packages

### Current Behavior

I use DT to analyze my projects developed in PHP with the Symfony framework, and I've noticed an unexpected behavior with certain PHP packages regarding the presence or absence of the 'v' in the version number.

By looking at the code, it turns out that the 'v' is removed before calling the OSS index API, so for a version like v7.2.0, we end up with 7.2.0, which doesn't exist on the OSS side.

Because of this behavior, I end up with vulnerabilities that are not reported in DT, since the OSS index doesn't return them if there are any, due to the version number not matching on their side.

### Steps to Reproduce

1. Enable the OSS Index analyzer
2. Create a project
3. Upload a SBOM file with PHP packages that have a 'v' in their version number, such as symfony/http-client in version v7.1.7
4. Analyze the SBOM (Automatically after the upload)
5. Check the vulnerabilities detected and ascertain that vulnerabilities of packages with a 'v' aren't present

### Expected Behavior

The expected behavior would be that, regardless of whether the version number includes the 'v' or not, vulnerabilities should be reported for any PHP package.

### Dependency-Track Version

4.12.x

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start with the reproduction: enable the OSS Index analyzer and upload an SBOM containing symfony/http-client v7.1.7. Trace version handling before the OSS Index API request; the report identifies removal of the leading 'v' but names no source files or tests. Done means verifying that PHP package vulnerabilities are reported with and without the prefix. Confirm the issue still reproduces and seek maintainer input, since activity stopped over a year ago.

Written by the indexing model from the issue text.