V4 DT using OSV as the vulnerability source is not identifying all Severitys

### Current Behavior

Due to the changes in Sonatype we had to use a different source vulnerabilities and moved to OSV.

The problem is that OSV is giving a much larger set of Unassigned severities in the output.

In a recent product it had 201 Unassigned severities, but by running an additional script to get the data from NVD, all the unassigned vulnerabilities had their Severities identified.

Before

Vulnerabilities by Severity:
Number of CRITICAL Vulnerabilities: 58, or 4.8%
Number of HIGH Vulnerabilities: 415, or 34.2%
Number of MEDIUM Vulnerabilities: 431, or 35.6%
Number of LOW Vulnerabilities: 107, or 8.8%
Number of Unassigned Vulnerability Severity: 201, or 16.6%
Total Number of DT Vulnerabilities: 1212
Total Number of High or Critical Severity Vulnerabilities: 473
Number of High or Critical Vulnerabilities older than 180 days: 197, or 41.6%
Number of Vulnerabilities in CISA Known Exploited Vulnerabilities (KEV) Catalog: 2, or 0.2%
Number of CWEs in 2025 CWE Top 25 Most Dangerous Software Weaknesses: 418, or 34.5%

After

Vulnerabilities by Severity:
Number of CRITICAL Vulnerabilities: 115, or 9.5%
Number of HIGH Vulnerabilities: 444, or 36.6%
Number of MEDIUM Vulnerabilities: 531, or 43.8%
Number of LOW Vulnerabilities: 122, or 10.1%
Number of Unassigned Vulnerability Severity: 0, or 0.0%
Total Number of DT Vulnerabilities: 1212
Total Number of High or Critical Severity Vulnerabilities: 559
Number of High or Critical Vulnerabilities older than 180 days: 206, or 36.9%
Number of Vulnerabilities in CISA Known Exploited Vulnerabilities (KEV) Catalog: 2, or 0.2%
Number of CWEs in 2025 CWE Top 25 Most Dangerous Software Weaknesses: 418, or 34.5%

This is a significant difference.

My guess is this is an OSV hiccup, but since a lot vulnerabilities from OSV have a CVE ID in the Alias, DT should use that to get the missing severities.

Not sure if this will apply to v5, but I wopuld have thought it likely.

### Steps to Reproduce

1.

### Expected Behavior

Correctly identify all vulnerability Severities

### Dependency-Track Version

4.x

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported