Missing Vulnerabilities from CycloneDX BOM upload

### Current Behavior:
Uploaded a CycloneDX BOM to a new project and none of the vulnerabilities reported in the BOM made it into the audit. I searched the open/closed issues and found that https://github.com/DependencyTrack/dependency-track/issues/744 explained something similar.

The suggestion was to follow the [FAQ](https://docs.dependencytrack.org/FAQ/) which mentions specifically this:

> I expect to see vulnerable components but I don’t:
> Most common reason: You have yet to enable the Sonatype OSS Index Analyzer. It is not enabled by default but is necessary to scan dependencies represented by Package URLs.

There are a couple of issues here:

1) The FAQ implies that Package URLs are a hard requirement, but the CycloneDX spec mentions that:
> If PURL is not an option or not all components represented in the BOM contain a PURL, then UUID is recommended

2) We are uploading a BOM with the vulnerability extension. Specifically, the example XML from CycloneDX used here: https://cyclonedx.org/ext/vulnerability/ which has PURLs and vulnerabilities

3) It is not clear from reading the documentation or after uploading a BOM with vulnerabilities, that:
* PURLs are absolutely required
* Vulnerabilities are (seemingly) not supported

### Steps to Reproduce:
Upload any of the examples in https://cyclonedx.org/ext/vulnerability/

### Additional Details:

I think this is more of a documentation enhancement rather than a bug. There are a few places that should highlight the strict requirements (e.g. PURLs) and that there is no support for the vulnerability extension in CycloneDX.

From searching the docs, these are some places where I think might make sense, perhaps there are other good spots as well:

* https://docs.dependencytrack.org/best-practices/
* https://docs.dependencytrack.org/FAQ/
* https://docs.dependencytrack.org/analysis-types/outdated-components/
* https://docs.dependencytrack.org/datasources/repositories/

In places where it is noted that DependencyTrack uses PURLs, there should be an emphasis on the requirement. For example, this line with _"relies"_:

> Dependency-Track relies on Package URL (PURL) to identify the ecosystem

Could be changed to _"requires"_ :

> Dependency-Track requires Package URL (PURL) to identify the ecosystem