[fluss-client][ fluss-flink-*] Uber-jars leak com.fasterxml.jackson.core alongside the shaded copy

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Fluss version

main (development)

### Please describe the bug 🐞

The published fluss-client and fluss-flink-* uber-jars each ship jackson-core twice:

1. correctly relocated under org/apache/fluss/shaded/jackson2/com/fasterxml/jackson/core/… and
2. an unrelocated copy at the root com/fasterxml/jackson/core/…

The unrelocated copy is an old jackson-core (2.15.x). Because it sits com.fasterxml.jackson.core package, it shadows the jackson-core a downstream application puts on its classpath. Any app using a newer jackson (e.g. 2.18.x) then breaks at runtime in our case YAML config loading:

```
Exception in thread "main" java.lang.NoSuchMethodError: 'com.fasterxml.jackson.core.JsonToken com.fasterxml.jackson.dataformat.yaml.YAMLParser._updateToken(com.fasterxml.jackson.core.JsonToken)'
at com.fasterxml.jackson.dataformat.yaml.YAMLParser.nextToken(YAMLParser.java:532)
at com.fasterxml.jackson.databind.ObjectMapper._readTreeAndClose(ObjectMapper.java:4854)
at com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:3199)
```

_updateToken was added in jackson-core 2.16, but the leaked 2.15.x jackson-core wins the class-load race, so jackson-dataformat-yaml 2.18.x fails.

Same result for fluss-flink-2.2 , fluss-fs-s3, which ships only the unrelocated jackson-core 2.15.3. fluss-common is clean, so the unrelocated copy enters during the client/flink uber-jar assembly, a transitive com.fasterxml.jackson.core:jackson-core gets bundled without passing through the com.fasterxml.jackson → org.apache.fluss.shaded.jackson2.com.fasterxml.jackson relocation (the relocated set comes from the pre-shaded fluss-shaded-jackson artifact).

Expected
The uber-jars should expose no classes under the root com/fasterxml/jackson/**. Either relocate every jackson class (add/extend the com.fasterxml.jackson relocation rule so it also cover the transitively-bundled jackson-core), or exclude the transitive plain jackson-core from the shade artifactSet so only the pre-shaded fluss-shaded-jackson classes remain.

Environment

- Fluss: 0.9.0-incubating / 0.9.1-incubating (also reproduced on 1.0-SNAPSHOT)
- Leaked jackson-core: 2.15.x; app jackson: 2.18.2
- Flink 2.2, Java 21

### Solution

_No response_

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Start by locating the uber-jar and shading configuration for fluss-client and the fluss-flink-* artifacts, then reproduce the issue by inspecting their contents for both relocated and root com/fasterxml/jackson classes. Done means the published uber-jars contain no classes under the root com/fasterxml/jackson/** path while retaining the relocated copy.

Written by the indexing model from the issue text.