[fix][sec] Upgrade dependency-check-maven and remove javax.el

[poorbarcode]

Motivation

See the report of the OWASP dependency check : https://github.com/apache/pulsar/actions/runs/4362250208/jobs/7632389328

Error:  Failed to execute goal org.owasp:dependency-check-maven:8.0.1:aggregate (default) on project pulsar: 
Error:  
Error:  One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': 
Error:  
Error:  aws-json-protocol-2.10.56.jar: CVE-2022-45688(7.5)
Error:  google-http-client-gson-1.41.0.jar: CVE-2022-45688(7.5)
Error:  jackson-core-2.13.4.jar: CVE-2022-45688(7.5)
Error:  jackson-jaxrs-json-provider-2.13.4.jar: CVE-2022-45688(7.5)
Error:  jackson-module-jsonSchema-2.13.4.jar: CVE-2022-45688(7.5)
Error:  jakarta.json-api-2.0.1.jar: CVE-2022-45688(7.5)
Error:  javax.el-3.0.0.jar: CVE-2021-28170(7.5)
Error:  jjwt-api-0.11.1.jar: CVE-2022-45688(7.5)
Error:  json-utils-2.17.[12](https://github.com/apache/pulsar/actions/runs/4362250208/jobs/7632389328#step:11:13)8.jar: CVE-2022-45688(7.5)
Error:  pom.xml: CVE-2022-34917(7.5), CVE-2023-25194(8.8)
Error:  
Error:  See the dependency-check report for more details.
Error:  -> [Help 1]
Error:  
Error:  To see the full stack trace of the errors, re-run Maven with the -e switch.
Error:  Re-run Maven using the -X switch to enable full debug logging.
Error:  
Error:  For more information about the errors and possible solutions, please read the following articles:
Error:  [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Error:  
Error:  After correcting the problems, you can resume the build with the command
Error:    mvn <args> -rf :pulsar
Error: Process completed with exit code 1.

Modifications

• [CVE-2022-45688] is a mistake of the project dependency-check-maven, so do upgrade dependency-check-maven to version 8.1.2.
• CVE 2020 26939: make the version of project BC unify into 1.69
• CVE-2021-28170 remove lib javax.el
• [CVE-2022-34917] & [CVE-2023-25194] is a wrong report, It seems to treat pulsar-io-kafka-connect-adaptor as a lib of Kafka, so remove these two checks

pulsar-io-kafka-connect-adaptor-3.0.0-SNAPSHOT.jar (pkg:maven/org.apache.pulsar/pulsar-io-kafka-connect-adaptor@3.0.0-SNAPSHOT, cpe:2.3:a:apache:kafka:3.0.0:snapshot:*:*:*:*:*:*, cpe:2.3:a:apache:pulsar:3.0.0:snapshot:*:*:*:*:*:*) : CVE-2023-25194, CVE-2022-34917

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

Matching PR in forked repository

PR in forked repository:

• [ci] CVE poorbarcode/pulsar#76

[poorbarcode]

/pulsarbot rerun-failure-checks