Bump avro, fix CVE-2024-47561

[damccorm]

Fixes #33144

---

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
• Update CHANGES.md with noteworthy changes.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[damccorm]

May go with #33159 depending on how that goes. Update - can't go to 1.12.0 because of Java compatability issues

[damccorm]

R: @Abacn

[github-actions]

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment assign set of reviewers

[Abacn]

I found the fix isn't effective, due to a logic in BeamModulePlugin here:

beam/buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy

Line 1268 in 76bcec0

def librariesWithVersion = project.library.java.values().findAll { it.split(':').size() > 2 }

which we get

        force "org.apache.avro:avro:1.11.4"
        force "org.apache.avro:avro:1.11.3:tests"

and one always get avro:1.11.3