[BugFix][CVE] Exclude unused avro-ipc that bundles vulnerable jquery 1.4.2 (backport #76270)

[mergify]

Why I'm doing:

avro-ipc-1.11.4.jar ships jquery-1.4.2.min.js (CVE-2011-4969, CVE-2014-6071 and six more jQuery XSS CVEs, two of them rated critical by downstream scanners) as static assets of Avro's stats server, which StarRocks never runs. Scanning the whole build output, the only class that references org.apache.avro.ipc is avro-mapred's tether/TetheredProcess (Avro's tethered-MapReduce debugging feature, also unused), so the jar is dead weight on both sides it ships to:

• FE classpath: spark-core_2.12 -> avro-mapred -> avro-ipc
• BE hive-reader lib: direct avro-mapred dependency drags in avro-ipc + avro-ipc-jetty

Upgrading Avro does not help: the latest avro-ipc 1.12.1 still bundles the same jquery 1.4.2.

What I'm doing:

Pom/gradle-only, no Java code changes:

1. Exclude avro-ipc from spark-core (fe) and avro-ipc/avro-ipc-jetty from avro-mapred (hive-reader). Avro core and avro-mapred stay untouched — org.apache.avro.mapred.FsInput etc. remain on the classpath for Hive Avro reads.
2. Keep org.tukaani:xz as an explicit dependency: it used to reach fe/lib only through avro-ipc, while commons-compress, clickhouse-jdbc and 5 other shipped jars still reference it. Without this, the exclusion would silently drop the XZ codec.
3. Ban avro-ipc/avro-ipc-jetty in the maven-enforcer gates (fe + java-extensions root poms) so a future dependency bump cannot re-introduce them.
4. Mirror everything in the Gradle build (fe/build.gradle.kts, fe/fe-core/build.gradle.kts).

Verification (full FE rebuild + BE hive-reader repackage):

• fe/lib is byte-identical minus avro-ipc-1.11.4.jar (the explicit xz keeps xz-1.9.jar in place); no jquery-1.4* asset remains anywhere in fe/lib.
• FE starts clean, metadata queries work, zero ClassNotFound/NoClassDefFound in fe.log.
• hive-reader-lib drops avro-ipc/avro-ipc-jetty; hive-reader's TestHiveScanner (real .avro file reads through AvroSerDe/AvroContainerInputFormat) passes with the exclusion in place.
• Both maven reactors pass validate with the new enforcer bans active.

What type of PR is this:

• BugFix
• Feature
• Enhancement
• Refactor
• UT
• Doc
• Tool

Does this PR entail a change in behavior?

• Yes, this PR will result in a change in behavior.
• No, this PR will not result in a change in behavior.

If yes, please specify the type of change:

• Interface/UI changes: syntax, type conversion, expression evaluation, display information
• Parameter changes: default values, similar parameters but with different default values
• Policy changes: use new policy to replace old one, functionality automatically enabled
• Feature removed
• Miscellaneous: upgrade & downgrade compatibility, etc.

Checklist:

• I have added test cases for my bug fix or my new feature
• This pr needs user documentation (for new or modified features or behaviors)
  • I have added documentation for my new feature or new function
  • This pr needs auto generate documentation
• This is a backport pr

Bugfix cherry-pick branch check:

• I have checked the version labels which the pr will be auto-backported to the target branch
  • 4.1
  • 4.0
  • 3.5

🤖 Generated with Claude Code

---

This is an automatic backport of pull request #76270 done by Mergify.