Internal analyzer findings persist after all affected components are removed from an internal vulnerability

### Current Behavior

When an INTERNAL vulnerability is updated and all of its affected components are removed, the VulnerableSoftware records are synchronized correctly, but findings previously created by the internal analyzer remain attached to the matched components. Since the internal analyzer only ever adds findings, these stale findings persist indefinitely — components keep showing a vulnerability that, per its own definition, no longer affects anything.

### Steps to Reproduce

1. Create a project with a component, e.g. purl pkg:maven/com.acme/acme-lib@1.0.0
2. Create an INTERNAL vulnerability with an affected component matching that purl
3. Let the internal analyzer run (BOM upload or portfolio analysis) — a finding is created for the component
4. Edit the vulnerability and remove all affected components
5. The component still shows the finding

### Expected Behavior

When the affected-components list of an INTERNAL vulnerability is emptied, findings attributed to INTERNAL_ANALYZER for that vulnerability are removed and component metrics are refreshed.

### Dependency-Track Version

4.x

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

No source file or test is named in the issue. Start by tracing the INTERNAL vulnerability update path and the INTERNAL_ANALYZER finding cleanup and metric refresh behavior; reproduce the five steps, then add coverage for removing all affected components and verify that stale findings disappear and metrics refresh.

Written by the indexing model from the issue text.