[Bug] Elasticsearch Java version has a vulnerability CVE-2023-46673, CVE-2023-46674, CVE-2023-31419, CVE-2023-31417, CVE-2023-31418

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Version

For pulsar version: `3.1.2` on branch: `branch-3.1` facing moderate vulnerability
[CVE-2023-46673](https://github.com/advisories/GHSA-285m-vhfq-xx4h), [CVE-2023-46674](https://github.com/advisories/GHSA-rv74-m283-5j95), [CVE-2023-31419](https://github.com/advisories/GHSA-qwrx-45xf-jjf7), [CVE-2023-31417](https://github.com/advisories/GHSA-99pc-69q9-jxf2), [CVE-2023-31418](https://github.com/advisories/GHSA-2cqf-6xv9-f22w), related to packages:
- org.elasticsearch:elasticsearch
- org.elasticsearch:elasticsearch-hadoop
- co.elastic.clients:elasticsearch-java

Below is the versions available in pulsar -
- 8.5.2

Maven Dependency

- pulsar - org.apache.pulsar 3.1.2

### Minimal reproduce step

Run Pulsar CI workflow on pulsar branch - `branch-3.1`

### What did you expect to see?

Expected to pass the `OWASP dependency check` under `Pulsar CI` workflow.

### What did you see instead?

Vulnerability
```
Error: Failed to execute goal org.owasp:dependency-check-maven:8.2.1:aggregate (default) on project pulsar:
Error:
Error: One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
Error:
Error: elasticsearch-java-8.5.2.jar: CVE-2023-46673(7.5), CVE-2023-46674(7.8), CVE-2023-31419(7.5), CVE-2023-31417(7.5), CVE-2023-31418(7.5)
Error: elasticsearch-rest-client-8.5.2.jar: CVE-2023-46673(7.5), CVE-2023-46674(7.8), CVE-2023-31419(7.5), CVE-2023-31417(7.5), CVE-2023-31418(7.5)
```

### Anything else?

_No response_

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Start with the Pulsar CI workflow on branch-3.1 and the OWASP dependency-check output, then locate the Maven declarations for elasticsearch-java 8.5.2 and the related Elasticsearch dependencies. Done means updating the vulnerable versions and rerunning Pulsar CI so the OWASP dependency check passes without the listed CVEs.

Written by the indexing model from the issue text.