[CVE] Replace `github.com/hamba/avro` usage

**Is your feature request related to a problem? Please describe.**

The [`github.com/hamba/avro`](https://github.com/hamba/avro) library is reporting a high severity CVE [GO-2026-5048](https://github.com/advisories/GHSA-mx64-mj3q-7prj) for all versions up to and including `v2.31.0`.

Since the project is archived, any remediation requires that the dependency be swapped out for an alternative.

**Describe the solution you'd like**

The easiest fix would be to replace the dependency with the fork at https://github.com/iskorotkov/avro and use the latest patch version `v2.33.1`.

Since this is only used by `pulsar/schema.go`, this would be a trivial fix:

https://github.com/apache/pulsar-client-go/blob/b47b690105f5063acf1200c58af8697ffcacf444/pulsar/schema.go#L32

However, I'm unsure of any other projects currently using this fork in production and have not independently audited it.

**Describe alternatives you've considered**

Adopt the new https://github.com/twmb/avro library, which would obviously require a refactor. I have quite high confidence in this library since the maintainer has a couple of high impact projects that they manage.

Also, this is currently being used by a couple of projects in production (see https://pkg.go.dev/github.com/twmb/avro?tab=importedby), namely https://github.com/apache/iceberg-go.

Could also re-consider https://github.com/apache/pulsar-client-go/issues/1191 to add caller-side support for setting the consumer's avro library.

**Additional context**

Happy to contribute a fix if the maintainers decide on a direction for this.

Start with pulsar/schema.go to inspect how github.com/hamba/avro is used. Compare the proposed iskorotkov/avro v2.33.1 replacement with twmb/avro and review the linked CVE context before choosing a direction. Done means the vulnerable dependency is replaced or the chosen alternative is integrated without breaking schema behavior.

Written by the indexing model from the issue text.