False positive: CVE-2024-3566 (Windows-only) incorrectly reported on Linux-based containers

### Current Behavior

Dependency-Track reports [CVE-2024-3566](https://nvd.nist.gov/vuln/detail/CVE-2024-3566) as affecting PHP components (e.g., `php@8.2.18`) used in Linux-based Docker containers (such as Alpine Linux).

However, this CVE is **specific to Windows environments**, due to its reliance on backslash (`\`) path traversal behavior, which is **not valid or exploitable on POSIX systems** like Linux.

The NVD explicitly includes the following CPE constraint:
`Running on/with`
`cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*`

Despite this, Dependency-Track applies the CVE to any project/component using a matching PHP version, **regardless of the actual operating system**, which leads to false positives for environments that will never be affected.

This appears to be caused by the fact that **Dependency-Track does not evaluate CPE platform constraints (like the OS)** when matching CVEs with components.

#### Example from SBOM

This is an excerpt from the CycloneDX SBOM being analyzed, showing the affected PHP component in an Alpine-based container:

```xml

php
8.2.18-r0
The PHP language runtime engine
pkg:apk/alpine/php@8.2.18-r0?arch=x86_64&distro=alpine-3.20.6
library