CVE-2025-48882 not detected

### Current Behavior

The CVE-2025-48882 vulnerability is not detected in BOMs with phpoffice/math v0.2.0 with internal analyzer or Trivy analyzer.

### Steps to Reproduce

1. Activate internal analyzer and/or Trivy analyzer.
2. Upload the attached BOM: [phpoffice_example.json](https://github.com/user-attachments/files/20551056/phpoffice_example.json)
3. See that there are no vulnerabilities

### Expected Behavior

1. Dtrack should detect CVE-2025-48882 in the uploaded BOM, as Trivy does when performing the scan outside Dtrack.

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

17

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported