[fix][sec] Eliminate commons-collections dependency

[lhotari]

Motivation

commons-collections is consider vulnerable in Sonatype. Issue is https://issues.apache.org/jira/browse/COLLECTIONS-701 . This problem is fixed in commons-collections4.
commons-collections gets pulled in to Pulsar from BookKeeper dependencies where it's an optional dependency of commons-beanutils ("The main commons-beanutils.jar has an optional dependency on Commons Collections" source).
It's also a dependency of org.apache.bookkeeper:stream-storage-java-client where it gets pulled in as a transitive dependency of hadoop-common. hadoop-common version 3.4.2 has replaced commons-collections with commons-collections4 to address the vulnerability.

Modifications

• exclude commons-collections from transitive dependencies of commons-beanutils
• exclude commons-collections from transitive dependencies of org.apache.bookkeeper:stream-storage-java-client
• upgrade hadoop version to 3.4.2 since it replaces commons-collections with commons-collections4

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.31%. Comparing base (6849824) to head (18d53f9).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##             master   #25024       +/-   ##
=============================================
+ Coverage     38.44%   74.31%   +35.87%     
- Complexity    13235    34065    +20830     
=============================================
  Files          1863     1920       +57     
  Lines        146149   150313     +4164     
  Branches      16972    17459      +487     
=============================================
+ Hits          56183   111711    +55528     
+ Misses        82305    29682    -52623     
- Partials       7661     8920     +1259     

Flag	Coverage Δ
inttests	26.35% <ø> (+0.07%)	⬆️
systests	22.91% <ø> (+0.03%)	⬆️
unittests	73.84% <ø> (+39.20%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1425 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.