[CVE][fs] Exclude vulnerable jetty-http dependency

[morazow]

Purpose

hadoop-azure transitively pulls in jetty-util / jetty-util-ajax, which then get
bundled into the shaded fluss-fs-azure jar. Jetty there is only used by Hadoop's web UI
server and the unused WASB native store — Fluss uses the ABFS client path and never touches
it. Excluding these keeps unused code out of the distributed FS jar and shrinks it.

As added motivation, this also drops Jetty 9.x jars that carry known CVEs (CVE-2026-2332,
CVE-2024-6763, CVE-2025-11143) from the bundle.

Brief change log

• Exclude org.eclipse.jetty:jetty-util and jetty-util-ajax from the hadoop-azure
  dependency in fluss-fs-azure.
• Update fluss-fs-azure NOTICE to drop the two now-unbundled Jetty entries.

Scope note: Only fluss-fs-azure actually bundles Jetty. hadoop-aliyun (oss) and
hadoop-huaweicloud (obs) do not bring Jetty into the bundle (hadoop-common is already
excluded), so no change is needed there. Likewise jetty-http / jetty-server /
jetty-servlet / jetty-webapp are never bundled, so excluding them is unnecessary.

Note on NOTICE: the license-check CI only fails on dependencies that are bundled but
missing from a NOTICE file; a dependency that is listed but no longer bundled is treated
as a tolerated (non-fatal) issue. So the stale Jetty entries do not fail CI and were
removed manually.

Tests

NA — dependency-only change; verified with mvn dependency:tree that no org.eclipse.jetty:*
remains in the fluss-fs-azure bundle.

API and Format

NA

Documentation

NA