Upgrade shaded Netty and HttpCore dependencies in JDBC 3.4.2 #1584

Databricks JDBC 3.4.2 still embeds security-affected versions of Netty and Apache HttpComponents Core in its uber JAR. Because these dependencies are relocated inside the driver, downstream Maven dependency management cannot override them.\n\nEmbedded dependency evidence:\n\n- io.netty:netty-buffer and netty-common 4.2.13.Final under META-INF/maven/io.netty\n- org.apache.httpcomponents.core5:httpcore5 and httpcore5-h2 5.3.6 under META-INF/maven/org.apache.httpcomponents.core5\n\nRequested updates:\n\n- Netty 4.2.15.Final or later. Dependency-Check maps current Netty CVEs broadly to netty-buffer 4.2.13.Final. The 3.4.2 JAR currently contains only the relocated buffer and util trees, so affected resolver, handler, codec, channel, HTTP/2, HTTP/3, QUIC, and SCTP implementations are absent; upgrading will nevertheless remove the vulnerable-version evidence and future-proof the bundled allocator dependency.\n- Apache HttpComponents Core 5.4.3 or later. CVE-2026-54399 affects the HTTP/1.1 parser through 5.4.2, and CVE-2026-54428 affects the HTTP/2 HPACK decoder through 5.4.2. The 3.4.2 JAR includes both httpcore5 and httpcore5-h2 5.3.6, including the HPACK decoder.\n\nRelated prior reports: #1436 and #1457. Those issues cover earlier driver and dependency versions; this report tracks the remaining versions in the current 3.4.2 release.