[V5] Missing Affected Components for internal vulnerabilities after v5 migration (API recreation works)

### Current Behavior

Since migrating to Dependency-Track v5, internal vulnerabilities (created pre-migration) are not displaying their affected components. The vulnerability shows the correct number of impacted projects:

but the "Affected Components" tab remains completely empty.

### Steps to Reproduce

1. Migrate an existing Dependency-Track instance to v5.x with internal vulnerabilites.
2. Navigate to an internal vulnerability that was created prior to the migration.
3. Observe that the "Affected Components" tab is empty, despite the impacted project count showing a value greater than zero.
4. Recreate the same internal vulnerability via the API using the pre-migration payload.
5. Observe that the "Affected Components" tab now populates correctly for the newly created vulnerability.

### Expected Behavior

Internal vulnerabilities created prior to the v5 migration should retain and display their affected components in the UI, consistent with the impacted projects count.

### Dependency-Track Version

5.x

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Begin with the v5 migration path for internal vulnerabilities and the API recreation flow; compare how each preserves affected components. Verify that a migrated vulnerability's Affected Components tab is populated and matches its impacted project count, while newly recreated vulnerabilities remain correct.

Written by the indexing model from the issue text.