CPE vulnerability matching misses valid alternative CPEs

### Current Behavior

Dependency-Track 4.14.2 appears to use only the primary cpe of a component for vulnerability matching.

For Qt 5.15.2.0, Syft 1.51.0 generates the following primary CPE:

cpe:2.3:a:Qt5:Qt5:5.15.2.0:*:*:*:*:*:*:*

The same component also contains alternative CPEs:

cpe:2.3:a:Qt5:Qt:5.15.2.0:*:*:*:*:*:*:*
cpe:2.3:a:Qt:Qt5:5.15.2.0:*:*:*:*:*:*:*
cpe:2.3:a:Qt:Qt:5.15.2.0:*:*:*:*:*:*:*

The expected Qt vulnerabilities are not reported with the primary Qt5:Qt5 CPE.

### Steps to Reproduce

Generate a CycloneDX 1.6 SBOM using Syft 1.51.0 for an application containing Qt 5.15.2.0.
Upload the SBOM to Dependency-Track 4.14.2.
Allow vulnerability analysis to complete.
Verify that the Qt component has the CPE:
cpe:2.3:a:Qt5:Qt5:5.15.2.0:*:*:*:*:*:*:*
Observe that the expected Qt vulnerabilities are not reported.
Manually change the component CPE in the Dependency-Track UI to:
cpe:2.3:a:Qt:Qt:5.15.2.0:*:*:*:*:*:*:*
Re-run vulnerability analysis.
The expected Qt vulnerabilities are reported.

### Expected Behavior

Dependency-Track should consider all valid CPE identities associated with the same component during vulnerability matching, rather than relying only on the primary cpe.

In this case, the alternative cpe:2.3:a:Qt:Qt:5.15.2.0:*:*:*:*:*:*:* identifies the affected component correctly, but the vulnerability is missed because the primary CPE is used exclusively.

This should be handled generically for CPE-based vulnerability matching and not be specific to Qt.

### Dependency-Track Version

4.x

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start by reproducing the issue with a CycloneDX 1.6 SBOM generated by Syft 1.51.0 for Qt 5.15.2.0, then inspect the vulnerability analysis path that uses the component's CPE. Verify the result with the primary CPE and with the listed alternative CPEs; done means generic CPE matching considers all valid identities and reports the expected Qt vulnerabilities.

Written by the indexing model from the issue text.