[Security] Bump org.json:json due to CVE-2022-45688

[bvolpato]

Comments suggested that org.json was in sync with libraries-bom, but when analyzing through

cd /tmp; wget https://repo1.maven.org/maven2/com/google/cloud/libraries-bom/26.22.0/libraries-bom-26.22.0.pom -O base.pom && mvn help:effective-pom -f base.pom -Doutput=effective.pom && cat effective.pom | grep -v 'dependencyManagement' > cleanup.pom && mvn dependency:tree -f cleanup.pom

We can see that it brings a much newer (and not in the CVE range) version:

[INFO] --- dependency:3.6.0:tree (default-cli) @ libraries-bom ---
[INFO] com.google.cloud:libraries-bom:pom:26.22.0
[INFO] +- com.google.cloud:google-cloud-bigquery:jar:2.31.1:compile
[INFO] |  +- org.json:json:jar:20230618:compile

[codecov]

Codecov Report

Merging #28962 (87cf1b2) into master (4a7c484) will increase coverage by 0.01%.
Report is 4 commits behind head on master.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master   #28962      +/-   ##
==========================================
+ Coverage   72.15%   72.17%   +0.01%     
==========================================
  Files         686      686              
  Lines      101629   101629              
==========================================
+ Hits        73329    73348      +19     
+ Misses      26724    26705      -19     
  Partials     1576     1576              

Flag	Coverage Δ
python	82.62% <ø> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files	Coverage Δ
sdks/python/apache_beam/ml/inference/base.py	93.51% <ø> (ø)

... and 13 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[bvolpato]

Run Java_GCP_IO_Direct PreCommit

[github-actions]

Assigning reviewers. If you would like to opt out of this review, comment assign to next reviewer:

R: @robertwb for label java.
R: @Abacn for label build.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).