Dependency-Track shows a higher severity than OSV for some CVSSv4 vulnerabilities

### Current Behavior

Dependency-Track shows a higher severity than OSV for some CVSSv4 vulnerabilities:
Example:
- OSV: [DEBIAN-CVE-2026-6791](https://osv.dev/vulnerability/DEBIAN-CVE-2026-6791) Medium (6.6)
- Dependency-Track: Critical (~9.0)

Dependency-Track appears to calculate CVSSv4 scores using the base score only. The Exploit Maturity is treated as exploited, even the official CVSS vector includes a lower Exploit Maturity value such as "E:U"

### Steps to Reproduce

1. OSV Vulnerability Sources Debian must be activated
2. Add a component with purl "pkg:deb/debian/glibc@2.41?arch=source&distro=debian-13"
3. Analyze the vulnerabilities and see the severity, which shows "Critical"

### Expected Behavior

Dependency-Track should show the same score and severity as OSV

### Dependency-Track Version

5.x

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start by reproducing the issue with the OSV Vulnerability Sources Debian source enabled and the component purl pkg:deb/debian/glibc@2.41?arch=source&distro=debian-13. Trace how the official CVSSv4 vector is converted into the displayed score, paying particular attention to the Exploit Maturity value E:U. Done means Dependency-Track reports the same score and severity as OSV for this vulnerability.

Written by the indexing model from the issue text.