Policy Evaluation: ALL Operator Flags Violations Across Multiple Vulnerabilities Instead of a Single Vulnerability

### Current Behavior

While evaluating policies for a component, the `evaluate()` method aggregates `PolicyConditionViolation` objects across all evaluators and counts **unique policy condition IDs**.

This means that if multiple vulnerabilities trigger the same condition, or if different vulnerabilities trigger different conditions, the system counts each **unique condition** only once.

As a result, for policies using the **ALL** operator, the policy is considered fully violated even if different vulnerabilities satisfy different policy conditions, as long as all conditions are hit at least once.

#### **Example Scenario**

* Component has 4 vulnerabilities
* Vulns 1 & 2 violate **Condition A**
* Vulns 3 & 4 violate **Condition B**
* Policy contains **Condition A** and **Condition B**

Current behavior:

* Unique violated conditions = `{A, B}` → count = **2**
* Policy condition count = **2**
* Therefore, the **ALL** operator evaluates to true
* All violations for all vulns are recorded

#### **Concern**

This makes the `ALL` operator behave like:

> “At least one vulnerability must violate each condition”

instead of:

> “A single vulnerability must simultaneously satisfy all conditions”

If this behavior is intentional, it would help to document it clearly.
If not intentional, the logic may need adjustment so that the “ALL” operator is evaluated per-vulnerability rather than globally across all vulnerabilities of the component.

#### **Relevant Code**

`evaluate()` → `policyConditionsViolated` increments based on:

```java
policyConditionsViolated += (int) policyConditionViolationsFromEvaluator.stream()
.map(pcv -> pcv.getPolicyCondition().getId())
.sorted()
.distinct()
.count();
```

This logic deduplicates conditions across **all** vulnerabilities and evaluators.

Our current Policy Violations are more Component centric, But Some conditions are vulnerability specific, so need to have Vuln centric logic there.

### Steps to Reproduce

1. Create a policy containing two conditions: **Condition A** (e.g., Severity = Critical) and **Condition B** (e.g., Age > 14 days).
2. Set the policy operator to **ALL**.
3. Create a project with a component that has **two vulnerabilities**:

* Vulnerability 1 satisfies **Condition A** but not **Condition B**.
* Vulnerability 2 satisfies **Condition B** but not **Condition A**.
4. Run a scan on the project.
5. Check the policy violations that are recorded.

### Expected Behavior

For vulnerability-centric policy conditions, the evaluation should determine whether a **single vulnerability** violates **all** required policy conditions, rather than aggregating violations at the component level.

**Possible Solutions**

1. Modify the behavior of the **ALL** operator so that it performs per-vulnerability checks.
2. Add a new operator (e.g., **AND**) that explicitly handles per-vulnerability policy evaluation.

### Dependency-Track Version

4.13.5

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported