[fix][sec] Bump async-http-client to 2.12.4 to address CVE-2024-53990

[Shawyeok]

Motivation

Get rid of CVE-2024-53990, eliminates CVE-2024-53990 completely from pulsar dependencies, you could see more context at: https://lists.apache.org/thread/fpg465pxytqkxbs57h7p3mckn9dwh3zq

Modifications

• Upgrade async-http-client to 2.12.4

Verifying this change

• Make sure that the change passes the CI checks.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

Matching PR in forked repository

PR in forked repository: Shawyeok#21

[lhotari]

@Shawyeok I've been handling this CVE and didn't notice your PR. There's actually more work to do in addressing dependency changes. I'm closing this PR in favor of #23732 where I've addressed the change from com.sun.activation:javax.activation to com.sun.activation:jakarta.activation.

[Shawyeok]

@Shawyeok I've been handling this CVE and didn't notice your PR. There's actually more work to do in addressing dependency changes. I'm closing this PR in favor of #23732 where I've addressed the change from com.sun.activation:javax.activation to com.sun.activation:jakarta.activation.

ok, cool.