Plan to address vulnerabilities reported on Druid 0.22.1

Hi,

This is following a [brief chat](https://the-asf.slack.com/archives/CJ8D1JTB8/p1643783372493569) with @cryptoe in the Apache #Druid slack channel. Logging this issue based on advice from there.

To summarize here, we recently upgraded to Druid `0.22.1` in the hope that some of the vulnerabilities reported on the earlier version `0.20.1` were addressed in it. However, the internal security team has reported many of the same issues on the newer version as well. Following are some of the vulnerabilities as examples. Note that, as shown below, some of them (about 7) need major version upgrade of the component identified.

| Components + Version | CVSS / CWE | Fix Version |
| ----------- | ------------------- |--------------------------------------|
| /opt/apache-druid-0.22.1/lib/hibernate-validator-5.2.5.Final.jar | [CVE-2017-7536](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7536) / [CWE-470](https://cwe.mitre.org/data/definitions/470.html)
[CVE-2019-10219](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10219) / [CWE-79](https://cwe.mitre.org/data/definitions/79.html)
[CVE-2020-10693](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10693) / [CWE-20](https://cwe.mitre.org/data/definitions/20.html) | 6.0.0.Alpha1 |
| /opt/apache-druid-0.22.1/extensions/druid-pac4j/oauth2-oidc-sdk-6.5.jar | [sonatype-2021-0429](https://git.soma.salesforce.com/pages/Infrastructure-Security/ast.github.io/sonatype-2021-0429.html) | 9.3.1 |
| /opt/apache-druid-0.22.1/extensions/druid-hdfs-storage/nimbus-jose-jwt-4.41.1.jar
/opt/apache-druid-0.22.1/extensions/druid-ranger-security/nimbus-jose-jwt-4.41.1.jar
/opt/apache-druid-0.22.1/hadoop-dependencies/hadoop-client/2.8.5/nimbus-jose-jwt-4.41.1.jar | [CVE-2019-17195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17195) | 7.8.1 |
| opt/apache-druid-0.22.1/lib/json-smart-2.3.jar | [CVE-2021-27568](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27568) / [CWE-754](https://cwe.mitre.org/data/definitions/754.html)
[CVE-2021-31684](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31684) / [CWE-787](https://cwe.mitre.org/data/definitions/787.html) | 2.4.4|

We are looking to understand the Druid project's plan for fixing these and any guidance on how to best mitigate these for now. Would appreciate help on this.

Start by reviewing the listed dependency paths under Druid 0.22.1, including lib, extensions, and hadoop-dependencies, alongside the reported CVEs and requested fix versions. Trace how these components are brought into the project and determine the upgrade or mitigation plan. Done means documenting actionable guidance for the reported vulnerabilities.

Written by the indexing model from the issue text.