Dependency-Track not matching Debian source-package vulnerabilities to binary packages

### Current Behavior

I'm seeing a discrepancy between Grype and Dependency-Track 5.0.4 when scanning a Debian 13 (Trixie) container.

Syft reports the installed package as:

perl-base 5.40.1-6
pkg:deb/debian/perl-base@5.40.1-6?arch=arm64&distro=debian-13&upstream=perl

The Syft SBOM also identifies perl as the upstream package.

Grype correctly reports DEBIAN-CVE-2026-8376 against perl-base.

Dependency-Track imports the same OSV advisory, but does not report it against the perl-base component.

I checked the vulnerability data in the Dependency-Track database and found that DEBIAN-CVE-2026-8376 is associated with:

pkg:deb/debian/perl?arch=source&distro=trixie

rather than perl-base.

As a test, I manually changed the affected PURL in Dependency-Track to a perl-base PURL. The vulnerability then appeared against the component. Changing it back caused the vulnerability to disappear again.

This makes me think the issue is with Dependency-Track matching Debian source packages to their binary packages when processing OSV advisories.

This may be related to #4015, which also appears to involve the perl/perl-base relationship.

Is Dependency-Track expected to resolve this source/binary package relationship for OSV Debian vulnerabilities? If so, this looks like a matching issue in 5.0.4.

### Steps to Reproduce

1. On a Debian 13 (Trixie) system, install perl-base version 5.40.1-6.
2. Generate a CycloneDX SBOM using Syft and upload it to a Dependency-Track 5.0.4 project.
3. Confirm the SBOM identifies the component as:
perl-base 5.40.1-6
pkg:deb/debian/perl-base@5.40.1-6?arch=arm64&distro=debian-13&upstream=perl
4. Ensure the OSV vulnerability database has been updated.
5. View the vulnerabilities for the perl-base component in Dependency-Track.
6. DEBIAN-CVE-2026-8376 is not reported against perl-base.
7. Scan the same system with Grype. Grype reports CVE-2026-8376 as affecting the installed perl package/component.

### Expected Behavior

Dependency-Track should identify DEBIAN-CVE-2026-8376 as affecting perl-base 5.40.1-6.

The Debian Security Tracker identifies the affected source package as perl, and perl-base is a binary package produced from that source package. The Syft SBOM also identifies perl as the upstream package for perl-base.

Dependency-Track should therefore resolve the Debian source-package to binary-package relationship when matching Debian OSV advisories, rather than requiring the SBOM component PURL to exactly match the source package PURL.

### Dependency-Track Version

5.x

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Reproduce the Debian 13 case using the listed Syft SBOM and OSV advisory, then trace how Dependency-Track matches the source PURL for perl to the binary perl-base component. No source files or tests are named; done means DEBIAN-CVE-2026-8376 is reported for perl-base 5.40.1-6 without manually changing the affected PURL.

Written by the indexing model from the issue text.