Failure to match a component and vulnerability in Google OSV in v4.14.2

### Current Behavior

In a project with a manually added component:
- Name: curl
- Version: many tried including 8.14.0-150700.7.13.1, 0, 1.0.0, etc.
- PURL: pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7

With Vulnerability Sources config:
- Google OSV: Enabled
- SUSE ecosystem: Enabled
- (NIST NVD and Google Advisories enabled too)

This Google OSV page shows references a vulnerability for curl:
https://osv.dev/vulnerability/SUSE-SU-2026:0903-1

If I copy and paste the exact PURL from the Google OSV page into the component and set a version less than the fixed version, after re-analyze Dependency Track shows 0 vulnerabilities for component:

Component BOM snippet:
```
{
"type" : "library",
"bom-ref" : "18fb94be-982a-4819-a2ca-4d9eeea0393d",
"name" : "curl",
"version" : "0",
"purl" : "pkg:rpm/suse/curl%26distro%3DSUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7"
},
```

Google OSV settings:

That particular vulnerability does appear to be in the PostgreSQL DB:
```
psql (16.11)
Type "help" for help.

deptrack=# SELECT *
FROM "VULNERABLESOFTWARE"
WHERE "ID" = 3976862;
ID | CPE22 | CPE23 | EDITION | LANGUAGE | OTHER | PART | PRODUCT | PURL | PURL_NAME | PURL_NAMESPACE | PURL_QUALIFIERS | PURL_SUBPATH | PURL_TYPE | PURL_VERSION | SWEDITION | TARGETHW | TARGETSW | UPDATE | UUID | VENDOR | VERSION | VERSIONENDEXCLUDING | VERSIONENDINCLUDING | VERSIONSTARTEXCLUDING | VERSIONSTARTINCLUDING | VULNERABLE
---------+-------+-------+---------+----------+-------+------+---------+-----------------------------------------------------------------------------------------------+----------------------------------------------------------------+----------------+-----------------+--------------+-----------+--------------+-----------+----------+----------+--------+--------------------------------------+--------+---------+----------------------+---------------------+-----------------------+-----------------------+------------
3976862 | | | | | | | | pkg:rpm/suse/curl%26distro%3DSUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 | curl&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7 | suse | | | rpm | | | | | | 58ae2d18-c3d1-486f-a664-54855d8d57fe | | | 8.14.1-150700.7.14.1 | | | | t
(1 row)

```

Since the vulnerability does show up in the DTrack DB and the PURL is an exact match I was worried it was not matching the version so I experimented with multiple versions, all earlier than the fixed version and did a re-analyze and waited after each change. Still could not get it to show any vulnerabilities for this component.

Possibly related to: https://github.com/DependencyTrack/dependency-track/issues/6172

### Steps to Reproduce

1. Install Dependency Track v4.14.2
2. Enable Google OSV vulnerability source and make sure SUSE ecosystem is enabled.
3. Create curl component in a project with the above PURL and a version < 8.14.1-150700.7.14.1
4. Re-analyze project

### Expected Behavior

Should show 1 Medium vulnerability for SUSE curl component

### Dependency-Track Version

4.x

### Browser

Microsoft Edge

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start by reproducing the issue with the SUSE curl PURL, a version below 8.14.1-150700.7.14.1, Google OSV and the SUSE ecosystem enabled. Compare the component's re-analysis result with the matching row in the VULNERABLESOFTWARE table and trace why the stored PURL and vulnerability version are not producing the expected finding. Done means the component reports the expected Medium vulnerability.

Written by the indexing model from the issue text.