CVSS v4 data is missing for source NPM in HTML and JSON reports

**Precondition**
- [x] I checked the issues list for existing open or closed reports of the same problem.

**Describe the bug**

This occurs with Vite JS 6.3.5 and GHSA-g4jq-h2w9-997c

When the source of a vulnerability is NPM, there is no CVSS data like `cvssv3` or `cvssv4` in the vulnerabilities section and also not in the suppressed vulnerabilities section of the HTML as well as the JSON report.

It also shows as _unscored_ and _severity Low_ although it has a CVSS v4 score of 2.3. We also have an automatic suppression rule for everything below 7 that doesn't work in this case. IMHO it's probably all for the same reason.

under vulnerabilities:
```
"vulnerabilities": [
{
"source": "NPM",
"name": "GHSA-g4jq-h2w9-997c",
"unscored": "true",
"severity": "low",
"cwes": [
"CWE-22",
"CWE-284",
"CWE-200"
],
"description": "### Summary\nFiles starting with the same name with the public directory
```

after adding a manual suppression, under suppressed vulnerabilities:
```
{
"source": "NPM",
"name": "GHSA-g4jq-h2w9-997c",
"cwes": [
"CWE-22",
"CWE-284",
"CWE-200"
],
"description": "### Summary\nFiles starting with the same name
```

There is however data for source NVD (under suppressed vulnerabilities):

```
{
"source": "NVD",
"name": "CVE-2025-58751",
"cvssv3": {
"baseScore": 5.3,
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"version": "3.1"
},
"cvssv4": {
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X",
"source": "security-advisories@github.com",
"type": "Secondary",
"version": "4.0",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"exploitMaturity": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"safety": "NOT_DEFINED",
"automatable": "NOT_DEFINED",
"recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"baseScore": 2.3,
"baseSeverity": "LOW"
},
"cwes": [
"CWE-22",
"CWE-284",
"CWE-200"
],
"description": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name
```

**Version of dependency-check used**
The problem occurs using version 12.1.5 of the gradle plugin

**Expected behavior**
There should be correct CVSS data in the reports.