Fix OWASP CPE suppression matching

[xiang17]

Summary

• Use the CPE 2.2 URI that Dependency-Check 13.0.0 compares against when suppressing false positives for azure-monitor-opentelemetry-autoconfigure.
• Document the CPE 2.3 report versus CPE 2.2 matching behavior and retain the trailing product boundary so opentelemetry_collector is excluded.

Validation

• Parsed buildscripts/dependency-check-suppressions.xml and asserted the scoped suppression uses cpe:/a:opentelemetry:opentelemetry:.
• ./gradlew :agent:agent:dependencyCheckAnalyze --rerun-tasks --no-build-cache is blocked because the configured NVD API key is empty (Invalid API Key, length of 0 too short to provided a masked partial key).