CVSS score as condition in policy violationa

### Current Behavior

Policy conditions can based on Severity and EPSS but not CVSS score.

I understand that historically not all data sources provided CVSS (as mentioned in #1948 etc) but is this still the case?

### Proposed Behavior

To align with other tools that works with CVSS scores, we want to be able to add a policy in Dependency Track:

cvss score [< > = ] x.y

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested