GH-44770: [Java] Update minor protobuf version to avoid CVE-2024-7254

[raulcd]

Rationale for this change

There seems to be a CVE affecting our current dependency:
GHSA-735f-pc8j-v9w8

What changes are included in this PR?

Update to latest minor which solves the issue.

Are these changes tested?

Via CI

Are there any user-facing changes?

No

• GitHub Issue: [Java] Apache Arrow — Stack overflow in Protocol Buffers Java Lite — CVE-2024-7254 #44770

[github-actions]

⚠️ GitHub issue #44770 has been automatically assigned in GitHub to PR creator.

[raulcd]

@github-actions crossbow submit -g java

[github-actions]

Revision: ad603bc

Submitted crossbow builds: ursacomputing/crossbow @ actions-a223b3698c

Task	Status
java-jars
test-conda-python-3.11-spark-master
verify-rc-source-java-linux-almalinux-8-amd64
verify-rc-source-java-linux-conda-latest-amd64
verify-rc-source-java-linux-ubuntu-20.04-amd64
verify-rc-source-java-linux-ubuntu-22.04-amd64
verify-rc-source-java-macos-amd64

[raulcd]

Not related with this PR but I saw we seem to be using a pretty old bundled version on C++, see:

arrow/cpp/thirdparty/versions.txt

Lines 95 to 96 in 00de992

	ARROW_PROTOBUF_BUILD_VERSION=v21.3
	ARROW_PROTOBUF_BUILD_SHA256_CHECKSUM=2f723218f6cb709ae4cdc4fb5ed56a5951fc5d466f0128ce4c946b8c78c8c49f

What is our policy for updating those dependencies? Do we have any? Should we update it? cc @kou

[lidavidm]

We can update the bundled version.

[kou]

We don't have our update policy. But we should keep updating dependencies as much as possible for performance and security.

[conbench-apache-arrow]

After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit ea8b1d3.

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 23 possible false positives for unstable benchmarks that are known to sometimes produce them.