[FLINK-39542] Upgrade avro to 1.11.5 that patches CVE-2025-33042

[Samrat002]

What is the purpose of the change

Address to CVE-2025-33042

Brief change log

Upgrade avro to 1.11.5

Verifying this change

Existing UT and IT

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): yes
• The public API, i.e., is any changed class annotated with @Public(Evolving): no
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
• The S3 file system connector: no

Documentation

• Does this pull request introduce a new feature?no
• If yes, how is the feature documented? not applicable

---

Was generative AI tooling used to co-author this PR?

No

[flinkbot]

CI report:

• 65b1268 Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build