[java-pubsub] Dependency to threetenbp should be obsolete?

**Is your feature request related to a problem? Please describe.**
google-cloud-pubsub depends on threetenbp but:
1. ThreeTenBP (ThreeTen Backport) is a backport of the Java 8 java.time API (JSR-310) to Java 6 and 7.
2. google-cloud-pubsub requires Java 8 or higher

**Describe the solution you'd like**
Remove dependency to threetenbp (bloats SBOM and CVE findings in threetenbp).

**Describe alternatives you've considered**
Workaround may be explicit exclusion when declaring the dependency.

**Additional context**
see https://github.com/googleapis/java-pubsub/blob/017eb0f78423fde3edd42a07677df49512085633/google-cloud-pubsub/pom.xml#L73

threetenbp reported to have:
https://nvd.nist.gov/vuln/detail/cve-2024-23081
https://nvd.nist.gov/vuln/detail/CVE-2024-23082