Plugin dependencies overrides are ignored and may lead to FPs

**Precondition**
- [x] I checked the issues list for existing open or closed reports of the same problem.

**Describe the bug**
When `scanPlugins` is enabled, dependency-check looks for CVEs in Maven plugins and their dependencies. If one of these dependencies is vulnerable, overriding the dependency to a more recent version usually fixes the vulnerability but dependency-check still sees the vulnerable version and reports false positives.

**Version of dependency-check used**
The problem occurs using version 12.2.x of the maven plugin.

**To Reproduce**
Steps to reproduce the behavior:
1. Create an empty maven project with the following configuration:
```xml




org.apache.maven.plugins
maven-dependency-plugin
3.11.0

org.apache.maven.plugins
maven-clean-plugin
3.5.0



org.owasp
dependency-check-maven
12.2.2


true





```
2. Run `mvn dependency-check:check` and see CVEs in plexus-utils-4.0.2:
```
One or more dependencies were identified with known vulnerabilities in dependency-check-plugin-cve:
[...]
plexus-utils-4.0.2.jar (pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2, cpe:2.3:a:codehaus-plexus:plexus-utils:4.0.2:*:*:*:*:*:*:*, cpe:2.3:a:utils_project:utils:4.0.2:*:*:*:*:*:*:*) : CVE-2025-67030
[...]
```
See that this dependency is pulled by maven-clean-plugin (and others) in the HTML report:

3. Override the version of plexus-utils pulled by maven-clean-plugin in `pluginManagement`:
```xml

org.apache.maven.plugins
maven-clean-plugin
3.5.0


org.codehaus.plexus
plexus-utils
4.0.3



```
4. Confirm that maven sees the correct version at runtime using `mvn dependency:resolve-plugins` (you need a recent version of `maven-depedency-plugin`, I used 3.11.0):
```
% mvn dependency:resolve-plugins
[...]
[INFO] org.apache.maven.plugins:maven-clean-plugin:jar:3.5.0
[INFO] org.apache.maven.plugins:maven-clean-plugin:jar:3.5.0
[INFO] org.codehaus.plexus:plexus-utils:jar:4.0.3
[...]
```
5. Run dependency-check again and see in the report that it still believes maven-clean-plugin is using a vulnerable version of `plexus-utils`

**Expected**: plugins overrides should fix vulnerabilities.
**Actual**: dependency-check reports FPs once non-vunerable transitive dependencies are forced in `pluginManagement`.