[security] Replace net.jpountz.lz4:lz4 with at.yawk.lz4:lz4-java

[massakam]

Motivation

net.jpountz.lz4:lz4 has been reported to contain multiple vulnerabilities, but it is no longer maintained and users are advised to migrate to the community version, at.yawk.lz4:lz4-java.
https://www.sonatype.com/security-advisories/cve-2025-12183

Changes

Pulsar has already done this replacement, so I made a similar change.
apache/pulsar#25032
Migrating to at.yawk.lz4:lz4-java will fix the vulnerabilities, but the security advisory also recommends replacing .fastDecompressor() with .safeDecompressor() for better performance.

[massakam]

OWASP Dependency Check is failing with the following error, which I believe is unrelated to this change and should be fixed in another PR:

Error: netty-transport-4.1.121.Final.jar (pkg:maven/io.netty/netty-transport@4.1.121.Final, cpe:2.3:a:netty:netty:4.1.121:::::::*): CVE-2025-55163(8.2), CVE-2025-58056(2.9), CVE-2025-58057(6.9)