[Sec] Pulsar-client's common-collections:common-collections is flagged as vulnerable to sonatype-2024-3350 with a high cvss score

### Search before reporting

- [x] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Read release policy

- [x] I understand that [unsupported versions](https://pulsar.apache.org/contribute/release-policy/#supported-versions) don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.

### User environment

Pulsar-Client version [4.0.6,4.1.+]

### Issue Description

pulsar-client shades in commons-collections:commons-collections 3.2.2 which is vulnerable to sonatype-2024-3350 DOS attack. bookkeeper 4.17.2 introduces this dependency by shading in commons-beanutils 1.11.0. Exploitability on pulsar appears non-existent, but this is coming up in enterprise security scan reports and becomes a headache for organizations with low risk tolerance.

### Error messages

```text

```

### Reproducing the issue

Classpath analysis

### Additional information

_No response_

### Are you willing to submit a PR?

- [x] I'm willing to submit a PR!

Start by inspecting the Pulsar client dependency and shading path that brings in BookKeeper 4.17.2 and commons-collections 3.2.2. Confirm whether the vulnerable dependency remains in the client classpath, then verify that supported Pulsar client versions no longer trigger the reported security scan finding.

Written by the indexing model from the issue text.