Requires verification for OSSF Malicious hash

### Current Behavior

Hello.
I would like to request improvement regarding malicious package in the OSV DB of Dependency-Track.
As a result of the test, it seems that the component being uploaded to the project is detecting malware based on the PURL. However, after checking the OSSF DB, **I found that there is a form without PURL**.
When scanning persistence through standardized SBOM, I would like to ask if it is possible to add a function to detect malicious code if the result of Sha-2 in the DB and the value of SHA-2 in the DT component match even if the PURL does not match.

### Proposed Behavior

I want to verify the malicious package by verifying sha-256 when scanning vulnerabilities.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested