Missing Sonatype OSS issues for PHP/composer packages

Given a PHP `composer.lock` file, pointing to a package that is listed as vulnerable on Sonatype OSS Index. Running latest dependency-check-cli (8.0.2) by serving Sonatype login credentials results in an empty report. Apparently, known vulnerabilities of PHP packages aren't reported at all.

**Reproduction guide**
I've attached a [ZIP file](https://github.com/jeremylong/DependencyCheck/files/10538224/composer.zip), containing a minimum `composer.json` (and resulting `composer.lock`) file. It requires PHP package `symfony/http-kernel@v5.1.4` which is [listed as vulnerable on OSS Index](https://ossindex.sonatype.org/component/pkg:composer/symfony/http-kernel@v5.1.4):
1. Place `composer.lock` file onto current working directory
2. Scan working directory using `dependency-check-cli`, providing the `--enableExperimental` option
3. Check generated report file(s) -> no vulnerabilities are reported

Let me know if you need further information to investigate.

Thank you in advance!