Vulnerabilities for Arista network device HW CPEs not showing up

### Current Behavior

Hi,

I've noticed that (at least some) of the Arista network device HW CPEs don't seem to be producing any vulnerabilities in Dependency-Track (currently on version 4.13). I've double checked that the CVEs exist in the NVD mirror files (e.g. `/mirror/nvd/nvdcve-1.1-2023.json.gz`).

An example is `cpe:2.3:h:arista:7150s-52:-:*:*:*:*:*:*:*`. I would expect Dependency-Track to produce the CVEs listed at the following NVD URL but it doesn't report any CVEs at all: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=cpe%3A2.3%3Ah%3Aarista%3A7150s-52%3A-%3A*%3A*%3A*%3A*%3A*%3A*%3A*&search_type=all&isCpeNameSearch=true

One of the CVEs listed on the NVD page is `CVE-2023-24512`. I've attached the CVE entry as mirrored by Dependency-Track in `/mirror/nvd/nvdcve-1.1-2023.json.gz`. Funnily enough, if I instead use the firmware `CPE cpe:2.3:o:arista:eos:4.23.10m:*:*:*:*:*:*:*` then Dependency-Track will show `CVE-2023-24512`.

One thing I did notice is that some of the Arista CVEs (including `CVE-2023-24512`) have an AND expression for the applicable CPE configurations that require both the HW CPE and SW CPE (although, it seems that Dependency-Track is not paying attention to this given that it's showing CVE-2023-24512 when just specifying the firmware CPE.

[CVE-2023-24512.json](https://github.com/user-attachments/files/20863712/CVE-2023-24512.json)

A related question: how would one represent the AND of CPEs? (in this case HW and SW CPE)?

### Steps to Reproduce

1. Create a device component with CPE string `cpe:2.3:h:arista:7150s-52:-:*:*:*:*:*:*:*` for its identity and click `Create`
2. Check the list of reported vulnerabilities

### Expected Behavior

I would expect to see the CVEs listed in https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=cpe%3A2.3%3Ah%3Aarista%3A7150s-52%3A-%3A*%3A*%3A*%3A*%3A*%3A*%3A*&search_type=all&isCpeNameSearch=true

### Dependency-Track Version

4.13.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported