Update Apache Avro in Cassandra connectors for CVE-2024-47561 [Critical]

I scanned the Debezium Server nightly image with Wiz CLI v1.31.0-de890c7 on 2026-08-10. The image digest was `sha256:f1a168a7accf69459024730565929b52e619e1c3edc8d7b3c7a372d6570bffc8`.

Wiz reports CVE-2024-47561 [Critical] for Apache Avro 1.11.3. This version comes from the Cassandra 4, Cassandra 5, and DSE connector dependency paths. Apache fixed the issue in Avro 1.11.4.

This is not a simple property update in the Debezium root POM. In the Cassandra 5 dependency tree, Confluent `kafka-connect-avro-converter` 7.0.16 brings Avro 1.11.3. I tested `-Davro.version=1.11.4`, but Maven still resolved Avro 1.11.3. We need dependency management in the Cassandra connector or an update of the dependency that brings Avro.

Acceptance criteria:

- Resolve Avro 1.11.4 or a later compatible fixed version in every affected Cassandra connector module.
- Run the Cassandra 4, Cassandra 5, and available DSE compatibility tests.
- Build the Debezium Server image.
- Scan the final image with Wiz CLI and confirm that CVE-2024-47561 [Critical] is removed.
- Document any version limit coming from the Confluent converter.

References:

- https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
- https://avro.apache.org/blog/2024/09/22/avro-1.11.4/
- DBZ #2233 is related to Avro availability at runtime, but it does not fix CVE-2024-47561 [Critical].