Scope gRPC dependencies and rely on grpc-bom for single version

[merlimat]

Summary

• Drop grpc-all (with its long exclusion list in the parent pom) and depend on the specific io.grpc:* artifacts each module actually uses; grpc-bom continues to enforce a single version across them.
• Drop grpc-protobuf from stream-storage-proto — dead after the LightProto migration; the generated code uses Netty ByteBuf only and no Java code anywhere imports io.grpc.protobuf.*.
• Drop pointless protobuf-java usages so statelib no longer needs the dependency:
  • statelib/Bytes.toLong(ByteString) was a dead overload — every caller uses the byte[] variant.
  • statelib/MVCCStoreImpl used TextFormat.escapeBytes once for an error message — replaced with JDK 17 HexFormat.of().formatHex.
  • bookkeeper-server/BookieImplTest had two no-op protobuf round-trips (ByteString.copyFrom(bytes).toByteArray() and unsafeWrap(...).asReadOnlyByteBuffer()) — replaced with plain byte[] / ByteBuffer.wrap.
• Update LICENSE-{all,server,bkctl}.bin.txt to match the new bundled jar set: drop entries for grpc-all, grpc-alts, grpc-auth, grpc-grpclb, grpc-opentelemetry, grpc-protobuf, grpc-protobuf-lite, grpc-services, grpc-testing, grpc-xds, grpc-rls, grpc-gcp-csm-observability, plus transitively-removed proto-google-common-protos, protobuf-java-util, api-common, google-http-client*, google-auth-library-*, auto-value-annotations, re2j, opencensus-*, conscrypt; clean up orphaned source-URL footnotes.

Module-by-module pom changes

Module	Before	After
parent pom.xml	grpc-bom import + grpc-all dependencyManagement entry with 8 exclusions	grpc-bom import only
stream/common	grpc-all, grpc-netty-shaded	grpc-api, grpc-stub, grpc-core, grpc-netty-shaded; grpc-inprocess, grpc-util (test)
stream/tests-common	grpc-all, grpc-netty-shaded, grpc-testing	grpc-api, grpc-stub, grpc-netty-shaded
stream/proto	+ grpc-protobuf	(dropped)
stream/clients/java/base	(silent transitive grpc-all)	explicit grpc-inprocess, grpc-netty-shaded; grpc-util (test)
metadata-drivers/etcd	grpc-all, grpc-netty-shaded	grpc-api, grpc-stub, grpc-netty-shaded

Net effect on the BK distribution

• gRPC: bookkeeper-dist/{all,server,bkctl} now ships 7 io.grpc:* jars (grpc-api, grpc-stub, grpc-core, grpc-context, grpc-inprocess, grpc-netty-shaded, grpc-util) — down from 18.
• protobuf: ships 1 protobuf-java jar — down from 3 (protobuf-java, protobuf-java-util, proto-google-common-protos). The remaining protobuf-java is now sourced only via prometheus-metrics-exposition-formats-no-protobuf, not via gRPC.
• metadata-drivers/etcd (which legitimately needs grpc-protobuf / protobuf-java for jetcd) is not pulled into the BK distribution or bookkeeper-server, so its protobuf-java usage doesn't affect dist licensing.

Test plan

• mvn -pl stream/common,stream/clients/java/base,stream/statelib -DstreamTests test — 229 tests pass (stream/common 41, clients/java/base 70, statelib 118).
• mvn -pl bookkeeper-server test -Dtest=BookieImplTest — 3 tests pass (covers the protobuf-removal refactor).
• mvn -DskipTests -pl '!native-io,!bookkeeper-dist/{all,server,bkctl}' --fae install — full reactor builds and installs.
• mvn -pl bookkeeper-dist/all dependency:tree — verified no io.grpc:grpc-all / grpc-protobuf / proto-google-common-protos / protobuf-java-util / google-auth-library-* / opencensus-* / conscrypt in the dist tree.
• CI to validate broader test surface.