SOLR-17900 follow-up: narrow four Hadoop-shaded CVE ranges to 9.0.0-9.9.0

[epugh]

Follow-up to #216. After digging back into the actual shaded dependency versions, the affected ranges on four of the Hadoop-client CVE statements were too broad.

The four CVEs are attributed to libraries shaded inside hadoop-client-runtime (in the hdfs module). Reading the embedded pom.properties from each hadoop-client-runtime-*.jar across the Solr 9.x line shows those shaded libs were bumped to fixed versions when Solr moved to Hadoop 3.4.1 in Solr 9.10.0 — one release earlier than the 9.10.1 bound the statements claimed:

CVE (shaded lib)	fix version	last vulnerable (Hadoop 3.4.0 = Solr 9.9.0)	fixed at
CVE-2023-52428 (nimbus-jose-jwt)	9.37.2	9.31	9.10.0 (3.4.1 → 9.37.2)
CVE-2024-25638 (dnsjava)	3.6.0	3.4.0	9.10.0 (3.4.1 → 3.6.1)
CVE-2024-26308 (commons-compress)	1.26.0	1.24.0	9.10.0 (3.4.1 → 1.26.1)
CVE-2024-29131/29133 (commons-configuration2)	2.10.1	2.8.0	9.10.0 (3.4.1 → 2.10.1)

So the range on those four moves from 9.0.0-9.10.1 to 9.0.0-9.9.0, with the body text updated to state the exact fix boundary.

The avro entry (CVE-2024-47561 / CVE-2023-39410) keeps its 9.0.0-9.10.1 range — avro stayed at 1.9.2 through 9.10.1 and is only fixed in 9.11 (branch_9x, Hadoop 3.4.3 → avro 1.11.4). Its body is updated to make that boundary explicit.

All statements remain not_affected / code_not_reachable; this only tightens the version metadata. Site builds and vexctl merge passes.

[epugh]

I accidentally merged the rpevious SOLR-17900 branch... so here is the one I wanted..