Thrift version update and unification

Is your feature request related to a problem? Please describe.

Hi

I have a question which came out from the security scan we did recently. Is there a reason on why thrift (github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7) is pinned? It does look like this one is from version 0.10. There is another one used by the ringpop-go (actually 2) one from 0.9.3 and another one from the no longer maintained repo. Latest thrift is 0.15 and beyond 0.13 have some active CVEs. Could you please consider reviewing the thrift versions in those 2 packages?

Here is some dependency graph

go.temporal.io/server github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7
go.temporal.io/server github.com/temporalio/ringpop-go@v0.0.0-20211012191444-6f91b5915e95
github.com/temporalio/ringpop-go@v0.0.0-20211012191444-6f91b5915e95 github.com/apache/thrift@v0.0.0-20150905105024-5bc8b5a3a5da
github.com/temporalio/ringpop-go@v0.0.0-20211012191444-6f91b5915e95 github.com/samuel/go-thrift@v0.0.0-20191111193933-5165175b40af

Describe the solution you'd like

Minimum thrift library version of 0.13, better 0.15

Describe alternatives you've considered

None available

Start with the dependency graph in the issue, checking the server's direct thrift dependency and the two thrift-related dependencies pulled through ringpop-go. Review whether the requested minimum thrift version can be unified without compatibility issues; done means the dependency graph no longer includes the older thrift versions and the security concern is addressed.