GET /api/v1/vulnerability/project/{uuid} returns only unique CVE IDs in v5.0.2

### Current Behavior

The v5.0.2 API server returns only unique CVEs.
In contrast, the v4.14.2 API server returns vulnerabilities including duplicate CVE IDs.

**attached files:**
* 113CVEs.txt: Output from `GET /api/v1/vulnerability/project/{uuid}` on v5.0.2
* 119CVEs.txt: Vulnerability list shown in the v5.0.2 frontend Audit Vulnerabilities view
* VDR.json: VDR exported from v5.0.2; all 119 CVEs are included

[113CVEs.txt](https://github.com/user-attachments/files/30214302/113CVEs.txt)
[119CVEs.txt](https://github.com/user-attachments/files/30214300/119CVEs.txt)
[VDR.json](https://github.com/user-attachments/files/30214384/VDR.json)

### Steps to Reproduce

1. Create a project for testing.
2. Open the "Components" tab of the project.
3. Upload the attached `SBOM_two_LibTIFF_versions.json` using "Upload BOM".
4. Wait until approximately 119 vulnerabilities (CVEs) have been identified.
5. Retrieve the project's vulnerabilities using `GET /api/v1/vulnerability/project/{uuid}`.

[SBOM_two_LibTIFF_versions.json](https://github.com/user-attachments/files/30214848/SBOM_two_LibTIFF_versions.json)

### Expected Behavior

The frontend UI, exported VDR, and API endpoint should all return the same number of CVEs.
The API should return the same 119 CVEs as the frontend UI and the exported VDR.

### Dependency-Track Version

5.x

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Begin by reproducing GET /api/v1/vulnerability/project/{uuid} after uploading SBOM_two_LibTIFF_versions.json, then compare it with the frontend Audit Vulnerabilities view and VDR.json. Use 113CVEs.txt, 119CVEs.txt, and the exported VDR to verify the discrepancy; done means the endpoint, UI, and VDR report the same 119 CVEs, including duplicate IDs.

Written by the indexing model from the issue text.