Exclude commons-collections from dependencies

[lhotari]

Motivation

commons-collections is marked to be vulnerable in Sonatype with identifier sonatype-2024-3350, although no public CVE exists for commons-collections 3.3.2 . Issue is https://issues.apache.org/jira/browse/COLLECTIONS-701 .
Since the dependency seems to be unnecessary, it's better to exclude it completely.

Changes

• exclude commons-collections from the transitive dependencies of commons-beanutils
  • commons-collections is an optional dependency of commons-beanutils
• upgrade hadoop version to 3.4.2 which replaces commons-collections with commons-collections4

---

In order to uphold a high standard for quality for code contributions, Apache BookKeeper runs various precommit
checks for pull requests. A pull request can only be merged when it passes precommit checks.

---

Be sure to do all the following to help us incorporate your contribution
quickly and easily:

If this PR is a BookKeeper Proposal (BP):

• Make sure the PR title is formatted like:
  <BP-#>: Description of bookkeeper proposal
e.g. BP-1: 64 bits ledger is support
• Attach the master issue link in the description of this PR.
• Attach the google doc link if the BP is written in Google Doc.

Otherwise:

• Make sure the PR title is formatted like:
  <Issue #>: Description of pull request
e.g. Issue 123: Description ...
• Make sure tests pass via mvn clean apache-rat:check install spotbugs:check.
• Replace <Issue #> in the title with the actual Issue number.

---