osv-scanner doesn't find Fedora vulnerabilities

When I scan using an spdx sbom, I see:

```
osv-scanner scan --sbom=SBOM-report-testproject-habi-20240410_0131-clean-licenses.spdx.json --verbosity verbose
Scanned /home/paul/SBOM-report-testproject-habi-20240410_0131-clean-licenses.spdx.json as SPDX SBOM and found 948 packages
No issues found
```

This is after I lowered the version of the libreswan package to one that is vulnerable to several CVEs:
```
{
"SPDXID": "SPDXRef-Package-370",
"downloadLocation": "https://libreswan.org/",
"externalRefs": [
{
"referenceCategory": "PACKAGE_MANAGER",
"referenceLocator": "pkg:rpm/fedora/libreswan@3.1-1.fc38",
"referenceType": "purl"
}
],
"licenseConcluded": "GPL-2.0-or-later AND MPL-2.0",
"licenseDeclared": "GPL-2.0-or-later AND MPL-2.0",
"name": "libreswan",
"originator": "Organization: Fedora Project",
"versionInfo": "3.1-1.fc38"
},

```
While https://osv.dev/list?ecosystem=&q=libreswan shows the vulnerabilities are known.