Handling of - (NA) in CPE

**Describe the bug**
The value of `-` for a CPE field is supposed to mean "NA" but it is not apparent how that should be handled differently to "ANY".

I have noticed it being used for the version in CVE-2024-1459, as `cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*`, causing that to not be detected at all.

**Version of dependency-check used**
Maven plugin 9.0.9

**To Reproduce**
```xml

io.undertow
undertow-core
2.3.12.Final

```

**Expected behavior**
I guess this should be a match, as the CVE description seems to indicate it applies to all versions (currently).