[fix][sec] Upgrade jline to 4.2.1 and picocli to 4.7.7, drop unused jline2

[lhotari]

Motivation

The Pulsar CLI/shell tooling bundles JLine and picocli, managed through the Gradle
version catalog (gradle/libs.versions.toml). Two things motivate this change:

1. Security. Pulsar packages org.jline:jline 3.21.0. This is the JLine aggregate
   ("uber") artifact that bundles every JLine module, including jline-remote-telnet
   (the org/jline/builtins/telnet/... classes are present in the jar). That module is
   affected by two HIGH-severity (CVSS 7.5) advisories in versions < 4.2.1, both fixed
   in 4.2.1:

   • GHSA-47qp-hqvx-6r3f — JLine3
     Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet
     NEW-ENVIRON Variables
   • GHSA-2r2c-cx56-8933 — JLine3
     Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry

   So the 3.21.0 bundle Pulsar ships contains the vulnerable telnet classes. Pulsar does
   not start a JLine telnet server (the shell only uses JLine for line editing/completion),
   so the code is not reachable through Pulsar's own usage, but the vulnerable classes are
   still packaged in the distribution and get flagged by dependency/security scanners.
   Upgrading jline to 4.2.1 incorporates the fixes.

2. Maintenance / cleanup. picocli (4.7.5) and jline (3.21.0) were behind their
   latest upstream releases, and the legacy jline2 (jline:jline 2.14.6) dependency is
   no longer a build dependency of any module — it was only declared in the server
   distribution packaging. Keeping unused and outdated dependencies increases the
   maintenance and licensing surface for no benefit.

Modifications

• Upgrade jline (org.jline:jline) from 3.21.0 to 4.2.1 (latest), which fixes
  GHSA-47qp-hqvx-6r3f and GHSA-2r2c-cx56-8933.
• Upgrade picocli from 4.7.5 to 4.7.7 (latest); picocli-shell-jline3 follows the same
  version reference.
• Remove the unused jline2 (jline:jline 2.14.6) dependency from the version catalog
  and from the server distribution packaging (distribution/server/build.gradle.kts).
• Remove the now-dead jline2 shade include/relocate entries (for the jline: Maven
  group / jline.* packages) from pulsar-functions/localrun-shaded. These were specific
  to JLine 2; the local-runner shaded classpath does not contain any JLine artifact
  (verified via runtimeClasspath), so the shaded jar contents are unchanged.
• Update the bundled LICENSE.bin.txt for the server and shell distributions to reflect
  the new jar versions and the removal of the JLine 2 jar.

Verifying this change

This change is a dependency upgrade / cleanup without new test coverage. It is covered by
the existing build and distribution binary-license check, and by
org.apache.pulsar.shell.PulsarShellTest, which exercises the Pulsar shell against the
upgraded JLine. Locally verified to pass: spotlessCheck, checkstyleMain,
checkstyleTest, :pulsar-client-tools main + test compilation, and PulsarShellTest
(the only module using JLine directly) against jline 4.2.1.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment