KAFKA-21185: bump lz4 to 1.12.0

[harmadasg]

Follow-up from #23609 (review)

The release notes of lz4 1.12.0 mentions possible breaking changes. What I could found out:

• Throw IOException for invalid or unsupported frame descriptors yawkat/lz4-java#133 and Make stream failures sticky in LZ4FrameInputStream and LZ4BlockInputStream yawkat/lz4-java#145 concerns changes with LZ4FrameInputStream -> Kafka is not affected as it relies on its own input stream implementation Lz4BlockInputStream
• Reject short output in LZ4DecompressorWithLength safe paths yawkat/lz4-java#126 input tightening for LZ4DecompressorWithLength -> this class is not imported in Kafka
• Additionally verified update with running Lz4CompressionTest, all tests passed

Reviewers: Chia-Ping Tsai chia7712@gmail.com

[chia7712]

I think this could be included in 4.3.2

Otherwise, the CVE scan can't pass

[github-actions]

A label of 'needs-attention' was automatically added to this PR in order to raise the
attention of the committers. Once this issue has been triaged, the triage label
should be removed to prevent this automation from happening again.