OWASP scores should be per-component, not global, to support contextual VEX ratings

### Current Behavior

After merging https://github.com/CycloneDX/specification/pull/722, I'm working on importing OWASP Risk Rating scores from CycloneDX VEX into Dependency-Track.

I've identified an architectural challenge: OWASP scores are currently stored at the `Vulnerability` level (global), not at the `Component` level. This seems inconsistent with how VEX [Analysis states](https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis) work, which are stored per component-vulnerability pair.

This means:

* One CVE has one OWASP score shared across all projects/components
* Cannot store different OWASP scores for the same vulnerability in different contexts

### Proposed Behavior

OWASP scores should be moved to the `Analysis` level (component-vulnerability scope) to properly support context-aware risk assessments from VEX.

**Why this is needed:**

OWASP Risk Rating methodology is `context-dependent`. The same CVE can have different risk scores in different applications based on:

* System exposure (internet-facing vs internal)
* Data sensitivity
* Business criticality
* Security controls in place

Benefits:

* ✅ Aligns OWASP scoring with the CycloneDX VEX specification
* ✅ Enables proper import of tools like [VENS](https://github.com/venslabs/vens) that generate contextual OWASP scores per project
* ✅ Consistent with existing Analysis architecture
* ✅ Supports context-aware risk assessments per project/component

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested