CVE-2025-55182 (React2Shell) not reported in next.js==15.5.6

### Current Behavior

React2shell was fixed in Next.js 15.5.7, but our DT instance did not report it with our project using 15.5.6. I investigated this and I think the root cause sits in DT internal analyzer

I'm using syft to generate BOM. It outputs such component description
```
{
"bom-ref": "pkg:npm/next@15.5.6?package-id=172dd823c5744d89",
"type": "library",
"name": "next",
"version": "15.5.6",
"cpe": "cpe:2.3:a:next.js:next.js:15.5.6:*:*:*:*:*:*:*",
"purl": "pkg:npm/next@15.5.6",
"properties": [
{
"name": "syft:package:foundBy",
"value": "javascript-lock-cataloger"
},
{
"name": "syft:package:language",
"value": "javascript"
},
{
"name": "syft:package:type",
"value": "npm"
},
{
"name": "syft:package:metadataType",
"value": "javascript-pnpm-lock-entry"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:vercel:next.js:15.5.6:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:next.js:next:15.5.6:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:next:next.js:15.5.6:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:vercel:next:15.5.6:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:next:next:15.5.6:*:*:*:*:*:*:*"
},
{
"name": "syft:location:0:path",
"value": "app/pnpm-lock.yaml"
}
]
}
```

Note the CPE - component uses `"cpe:2.3:a:next.js:next.js:15.5.6:*:*:*:*:*:*:*"`, but CVE-55182 lists `cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* (>=15.5.0|<15.5.7)` as affected. There is a mismatch in next.js vendors (`next.js` in syft vs `vercel` in CVE). This was addressed in https://github.com/anchore/syft/issues/4443 which includes correct CPE in component properties
```
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:vercel:next.js:15.5.6:*:*:*:*:*:*:*"
}
```

Despite this and fuzzy CPE matching enabled in DT internal analyzer, this dependency is marked as clean with no vulnerabilities

### Steps to Reproduce

1. Create project with `next@15.5.6:` dependency
2. Use latest syft 1.38.2 to generate BOM with `syft scan dir:. -o cyclonedx-json > bom.json`
3. Upload BOM to DependencyTrack

### Expected Behavior

DT should mark the project as vulnerable to React2Shell

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

17

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Reproduce the report with syft 1.38.2 and the supplied CycloneDX BOM, then trace Dependency-Track's internal analyzer and fuzzy CPE matching for the uploaded component. Compare the generated CPE properties with CVE-2025-55182's affected CPE range; done means the Next.js 15.5.6 dependency is reported as vulnerable.

Written by the indexing model from the issue text.