WordPress plugin vulnerabilities incorrectly matched to npm packages

### Current Behavior

Dependency-Track is incorrectly matching CVEs for WordPress plugins to npm packages that share the same name. For example, vulnerabilities for the "sirv" WordPress plugin (with CPE cpe:2.3:a:sirv:sirv:*:*:*:*:*:wordpress:*:*) are being flagged against the npm package pkg:npm/sirv@2.0.4.

### Steps to Reproduce

1. Create an SBOM containing the npm package sirv@2.0.4 using Syft or similar tool:
2. Upload the SBOM to Dependency-Track or scan using anchore/sbom-action
3. Review vulnerability findings for the sirv package
4. Observe that WordPress plugin CVEs are incorrectly matched to the npm package

### Expected Behavior

Dependency-Track should NOT match vulnerabilities to packages when there is an ecosystem mismatch.

### Dependency-Track Version

4.13.3

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported