KAFKA-20168 Upgrade Jetty from 12.0.22 to 12.0.32 to fix CVE-2025-5115 (#21461)

Upgrade Jetty from 12.0.22 to 12.0.32 to address

[GHSA-mmxm-8w33-wc4h](GHSA-mmxm-8w33-wc4h)
(MadeYouReset HTTP/2 DoS, CVSS 7.7 HIGH).

Note that GHSA-mmxm-8w33-wc4h only affects
the org.eclipse.jetty.http2:jetty-http2-common module. Kafka does not
depend on this module — its embedded Jetty servers (Connect RestServer
and Trogdor JsonRestServer) only use HTTP/1.1 via ServerConnector
without any HTTP2ServerConnectionFactory configuration. As such, the
attack vector is not applicable. This upgrade from 12.0.22 to 12.0.32 is
to keep the dependency up to date.

4.0: #21462
trunk: #21452

Reviewers: Chia-Ping Tsai <chia7712@gmail.com>

Author: mingyen066

LICENSE-binary

@@ -226,16 +226,16 @@ License Version 2.0:
 - jakarta.inject-api-2.0.1
 - jakarta.validation-api-3.0.2
 - javassist-3.30.2-GA
-- jetty-alpn-client-12.0.22
-- jetty-client-12.0.22
-- jetty-ee10-servlet-12.0.22
-- jetty-ee10-servlets-12.0.22
-- jetty-http-12.0.22
-- jetty-io-12.0.22
-- jetty-security-12.0.22
-- jetty-server-12.0.22
-- jetty-session-12.0.22
-- jetty-util-12.0.22
+- jetty-alpn-client-12.0.32
+- jetty-client-12.0.32
+- jetty-ee10-servlet-12.0.32
+- jetty-ee10-servlets-12.0.32
+- jetty-http-12.0.32
+- jetty-io-12.0.32
+- jetty-security-12.0.32
+- jetty-server-12.0.32
+- jetty-session-12.0.32
+- jetty-util-12.0.32
 - jose4j-0.9.6
 - jspecify-1.0.0
 - log4j-api-2.25.3

gradle/dependencies.gradle

@@ -66,7 +66,7 @@ versions += [
   jackson: "2.19.4",
   jacoco: "0.8.13",
   javassist: "3.30.2-GA",
-  jetty: "12.0.22",
+  jetty: "12.0.32",
   jersey: "3.1.10",
   jline: "3.30.4",
   jmh: "1.37",