Use pombump to handle spark dep bumps.

[vaikas]

Switch to using pombump. Has less CVEs, but they can not be currently removed.
Trying to bump libthrift-0.12.0.jar to 13 or later does not compile because API has changed.
jackson-mapper-asl-1.9.13 has not been updated since 2013.
hadoop-client-runtime-3.3.6 is the latest
Others are shaded jars.

Fixes:

Related:

Pre-review Checklist

For new package PRs only

• This PR is marked as fixing a pre-existing package request bug
  • Alternatively, the PR is marked as related to a pre-existing package request bug, such as a dependency
• REQUIRED - The package is available under an OSI-approved or FSF-approved license
• REQUIRED - The version of the package is still receiving security updates
• This PR links to the upstream project's support policy (e.g. endoflife.date)

For new version streams

• The upstream project actually supports multiple concurrent versions.
• Any subpackages include the version string in their package name (e.g. name: ${{package.name}}-compat)
• The package (and subpackages) provides: logical unversioned forms of the package (e.g. nodejs, nodejs-lts)

For security-related PRs

• The security fix is recorded in the advisories repo

For version bump PRs

• The epoch field is reset to 0

For PRs that add patches

• Patch source is documented

[vaikas]

There are still some other patches that need to get applied.