CVE-2026-59083 not returned by /v1/query for affected package pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.21

The record itself (`GET /v1/vulns/CVE-2026-59083`) correctly lists the affected range as `11.0.0-M1` through `11.0.23`:

```json
{
"id": "CVE-2026-59083",
"summary": "Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass",
...
"affected": [
{"introduced": "11.0.0-M1"}, {"last_affected": "11.0.23"},
...
]
}
```

But querying by package+version does not return it:

```
POST /v1/query
{"package":{"purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.21"}}
```

returns 10 other Tomcat CVEs affecting the same package/version (GHSA-2827-2mxx-j8pv and others), but **not** CVE-2026-59083, even though `11.0.21` falls squarely inside the record's own stated affected range.

Reproduced with `osv-scanner` (queries the same endpoint) and independently with `trivy` (own DB) — both miss this specific CVE for `tomcat-embed-core@11.0.21` while correctly surfacing the other 10 Tomcat CVEs on the identical artifact.

Looks like an indexing/linking gap between the record and the package-version query index, rather than a data issue in the record itself. Happy to provide the full purl list / more repro details if useful.