VEX import failed due to duplicated vulnerabilities

### Current Behavior

VEX upload fails when there are duplicated vulnerabilities within a project.

### Steps to Reproduce

1. Uploaded an SBOM of a NodeJS project to Dependency Track
2. Dependency Track found several vulnerabilities in particular two times the same vulnerability for different versions of [ajv](https://www.npmjs.com/package/ajv) (v6.12.6 and v8.17.1)
3. Tried to upload a VEX file with previous assessments and got the following error:

```
2026/07/10 14:49:35 ERROR migrate project error="import vex: {\"status\":400,\"title\":\"The uploaded BOM is invalid\",\"detail\":\"Schema validation failed\",\"errors\":[\"$.vulnerabilities: must have only unique items in the array\"]} (status: 400)"
```

### Expected Behavior

The VEX import shall succeed.

### Dependency-Track Version

5.x

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start by tracing the VEX import path described in the issue and reproduce the failure with duplicated vulnerabilities for different ajv versions. Check where the uploaded BOM is validated and add or update coverage for duplicate vulnerability entries; done means the VEX upload succeeds without the unique-items validation error.

Written by the indexing model from the issue text.