Collection Project shows the vulnerabilities in the UI, but returns an empty list with the REST API

### Current Behavior

I am using the Rest API call "/v1​/vulnerability​/project​/{uuid}" for a collection project with "aggregate direct children" collection logic.

The project contains one child and the child has vulnerabilities, which can be confirmed with the above mentioned API call using the child uuid and also on the UI.

But when I use that call for the collection project, I get an empty list.

### Steps to Reproduce

1. Open the swagger UI for the openapi.yaml
2. Try out the API call /v1​/vulnerability​/project​/{uuid} with the child uuid
3. Try out the API call /v1​/vulnerability​/project​/{uuid} with the collection Project uuid

### Expected Behavior

In the UI we are informed that "Metrics of collection project are calculated by aggregating numbers of all direct children", so the expected behavior would be that the API call returns a list, which is the aggregation of all the vulnerabilities from all its children.

### Dependency-Track Version

4.13.4

### Dependency-Track Distribution

Container Image

### Database Server

H2

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported