Updating an analysis fails without `project`, but `project` is never used and should just be ignored

### Current Behavior

Hey,
I found out that I can't add a comment or change the analysis state of a vuln via API. Every time I specify a project, component, and vuln, Dependency-Track adds the comment and changes the state, BUT in a completely different project. Without a project, Dependency-Track throws a 500, even though project isn't required according to Swagger.
It seems to me that the commit "0dbe529ca6f446c42f7ac30327d1e7e9cfdea6b0" by @nscuro broke the endpoint by removing the project filtering (no finger-pointing, just a heads-up — hopefully you're faster with research and fixing the problem :))

After a bit of research, I noticed that project has been deprecated. Now it's not entirely clear to me how I should reference a vuln when a component can be part of multiple projects.

### Steps to Reproduce

Add a comment to a vuln that has more than one affectedProject via /v1/analysis

### Expected Behavior

Create a comment / change state on the specified vuln/project/component

### Dependency-Track Version

4.x

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start with the /v1/analysis endpoint and its Swagger definition, then inspect commit 0dbe529ca6f446c42f7ac30327d1e7e9cfdea6b0 to understand the removed project filtering. Reproduce the failure with a vulnerability whose component has more than one affected project; done means comments and state changes target the specified vulnerability, project, and component without requiring an unused project field.

Written by the indexing model from the issue text.