[Task]: Also remove META-INF for excluded transitive dependencies in Beam vendored dependencies

### What needs to happen?

We vendor a few dependencies (nowadays only guava, grpc, calcite), where some transitive dependency were explicitly excluded, e.g. https://github.com/apache/beam/blob/b87629928c92b3df4ba88fb42184d5ed505dbe2e/vendor/calcite-1_28_0/build.gradle#L94-L95

But their META-INF still exists in the vendored jar artifact. This gives false positive vulnerability alerts for some user.

This tasks involves

- Investigate whether removing these META-INF would break Beam
- If not, improve the vendor build script to also exclude META-INF for these excluded transitive dependencies

### Issue Priority

Priority: 2

### Issue Components

- [ ] Component: Python SDK
- [x] Component: Java SDK
- [ ] Component: Go SDK
- [ ] Component: Typescript SDK
- [ ] Component: IO connector
- [ ] Component: Beam YAML
- [ ] Component: Beam examples
- [ ] Component: Beam playground
- [ ] Component: Beam katas
- [ ] Component: Website
- [ ] Component: Spark Runner
- [ ] Component: Flink Runner
- [ ] Component: Samza Runner
- [ ] Component: Twister2 Runner
- [ ] Component: Hazelcast Jet Runner
- [ ] Component: Google Cloud Dataflow Runner