Allow manually adding affected components to CVE's from NVD to fix misdetections for mismatching package names

### Current Behavior

This is similar to https://github.com/DependencyTrack/dependency-track/issues/59 but not for bad versions but for bad package identification.

For example, take "CVE-2013-7489", this was issued by the RedHat CNA for the 'python-beaker' package, as RedHat prefixes most of those packages with python-. The upstream was contacted, but the vulnerable upstream package actually is named 'pkg:pypi/beaker', not 'python-beaker'.

This causes DependencyTrack to not link the CVE-2013-7489 to the vulnerable component during analysis.

The only fix i know off is to create an internal vulnerability for pkg:pypi/beaker, that mentions the CVE-2013-7489 and explicitly adding the affected version to that. This is undesireable, as it creates duplicate identifiers for the same issue.

### Proposed Behavior

Allow to declare/attach additional explicit affected components to NVD CVE's (or other vulnerabilities from external sources), like it is possible for internal vulnerabilities.

While this does not allow the automated detection of vulnerabilities, it allows for proper vulnerability handling and analysis and creation of the correct VEX entries for the affected component or sub-component, once the gap has been identified by external inputs. This is especially helpful when communicating with outside sources that routinely mis-represent the affected packages names or versions.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested