fix kafka CVE-2023-25194, update kafka client to 3.4.0

[xie-shujian]

Description

• fix kafka CVE-2023-25194
• upgrade kafka client to 3.4.0, and upgrade three related jar
• upgrade spring kafka test to 2.9.6, add one more kafka coordinator package

Issues Resolved

• Resolves CVE-2023-25194 (High) detected in kafka-clients-3.0.2.jar #2431
• Related [CVE-2023-25194] Update Kafka dependency and resulting version diffs #2434
• Related fix kafka CVE-2023-25194, update kafka client to 3.4.0 #2481

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov-commenter]

Codecov Report

Merging #2484 (fd9cb92) into main (2df8acd) will decrease coverage by 0.01%.
The diff coverage is n/a.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@             Coverage Diff              @@
##               main    #2484      +/-   ##
============================================
- Coverage     61.19%   61.19%   -0.01%     
+ Complexity     3325     3324       -1     
============================================
  Files           260      260              
  Lines         18494    18494              
  Branches       3268     3268              
============================================
- Hits          11318    11317       -1     
  Misses         5578     5578              
- Partials       1598     1599       +1     

Impacted Files	Coverage Δ
...search/security/transport/SecurityInterceptor.java	75.38% <0.00%> (-0.77%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[peternied]

Nicely done!

[DarshitChanpura]

Backwards Compatibility failure for Windows CI is unrelated to changes in this PR.

[opensearch-trigger-bot]

The backport to 1.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.x 1.x
# Navigate to the new working tree
cd .worktrees/backport-1.x
# Create a new branch
git switch --create backport/backport-2484-to-1.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 7547d035ff11a00257f6c7e8316499e2138790e8
# Push it to GitHub
git push --set-upstream origin backport/backport-2484-to-1.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.x

Then, create a pull request where the base branch is 1.x and the compare/head branch is backport/backport-2484-to-1.x.

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-2484-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 7547d035ff11a00257f6c7e8316499e2138790e8
# Push it to GitHub
git push --set-upstream origin backport/backport-2484-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-2484-to-2.x.

[opensearch-trigger-bot]

The backport to 1.3 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.3 1.3
# Navigate to the new working tree
cd .worktrees/backport-1.3
# Create a new branch
git switch --create backport/backport-2484-to-1.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 7547d035ff11a00257f6c7e8316499e2138790e8
# Push it to GitHub
git push --set-upstream origin backport/backport-2484-to-1.3
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.3

Then, create a pull request where the base branch is 1.3 and the compare/head branch is backport/backport-2484-to-1.3.

[opensearch-trigger-bot]

The backport to 2.6 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.6 2.6
# Navigate to the new working tree
cd .worktrees/backport-2.6
# Create a new branch
git switch --create backport/backport-2484-to-2.6
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 7547d035ff11a00257f6c7e8316499e2138790e8
# Push it to GitHub
git push --set-upstream origin backport/backport-2484-to-2.6
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.6

Then, create a pull request where the base branch is 2.6 and the compare/head branch is backport/backport-2484-to-2.6.

[peternied]

@scrawfor99 FYI - these changes will not clearly backport to the 1.X/1.3 branches. They will need to manually be converted since the build script were rewrittne