Security checks on vendored deps.

### Problem description

The vendored libs [0] that are statically linked into the produced fluent-bit binaries aren't checked against CVEs, nor the current security scan Trivy is able to correctly detect its dependencies.

Some other commercial solutions as Black Duck are able to identify the function/method fingerprints and link them into particular versions of libraries that might be affected by CVE(s).

Vendored libs should at least be kept into a version table that we can use against a CVE check tool or dependabot-like tool so that any security issue can be addressed and the vendored libraries upgraded.

[0] https://github.com/fluent/fluent-bit/blob/146b9973aebbe613a1eb52cb9de7abc736dcbeac/src/CMakeLists.txt#L306