Inconsistent severity rating in vulnerability alias handling

### Current Behavior

Given a component with a vulnerability that is reported by both NVD and GHSA, DependencyTrack seems to take the severity value from a random element. In this case NVD reports a "medium" (4.3) while GitHub reports as "high severity".
Dependencytrack marks the GHSA as an alias to the NVD entry and takes (in one case) the NVD severity, giving a "medium" rating on the summary page. In a different case, it is reverted.

### Steps to Reproduce

Create a project with a component pkg:maven/commons-io/commons-io@2.11.0?type=jar - it will detect two vulnerability entries, consolidate the alias - and pick a severity for the project summary page (seemingly at random).

Github: https://github.com/advisories/GHSA-78wr-2p64-hpwj (rated High)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-47554 - where you can actually see that NVD didn’t even provide a score yet and thus took a rating from CISA-ADP which came in as a 4.3).

### Expected Behavior

Highest available rating is used.

### Dependency-Track Version

4.13.5

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported