OSV component version constraints are interpreted wrong

### Current Behavior

Dependency-Track reports a vulnerability in an OpenSSL version that is no longer affected by it. Specifically, it's the [UBUNTU-CVE-2025-68160](https://ubuntu.com/security/CVE-2025-68160) vulnerability, which should be fixed with version 3.0.13-0ubuntu3.7. I found several other vulnerabilities that I suspect are affected by the same error. However, this example was the easiest to describe.

**Affected versions in the OSV Database:**

3.0.10-1ubuntu2
3.0.10-1ubuntu2.1
3.0.10-1ubuntu3
3.0.10-1ubuntu4
3.0.13-0ubuntu2
3.0.13-0ubuntu3
3.0.13-0ubuntu3.1
3.0.13-0ubuntu3.2
3.0.13-0ubuntu3.3
3.0.13-0ubuntu3.4
3.0.13-0ubuntu3.5
3.0.13-0ubuntu3.6

https://osv.dev/vulnerability/UBUNTU-CVE-2025-68160

**Installed version**

3.0.13-0ubuntu3.7

**Constraints in Dependency Track for Noble:**

pkg:deb/ubuntu/edk2@2024.02-2ubuntu0.7?arch=source&distro=noble | OSV | 6 Mar 2026 at 08:52:49
pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.7?arch=source&distro=noble (<3.0.13-0ubuntu3.7) | OSV | 6 Mar 2026

Dependency Track does not report the same vulnerability from the CVE database.
https://www.cve.org/CVERecord?id=CVE-2025-68160

### Steps to Reproduce

1. Get a BOM File from any Ubuntu Installation with OpenSSL 3.0.13-0ubuntu3.7. Mine was from a docker image.

### Expected Behavior

The vulnerability isn't shown.

### Dependency-Track Version

4.13.6

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

17.4

### Browser

Microsoft Edge

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Reproduce the report with a BOM containing Ubuntu OpenSSL 3.0.13-0ubuntu3.7 and inspect how the OSV constraint “<3.0.13-0ubuntu3.7” is evaluated against the installed version. Compare the OSV and CVE results, then add coverage for this version constraint; done means the fixed OpenSSL version is no longer reported for UBUNTU-CVE-2025-68160.

Written by the indexing model from the issue text.