[improve][build] Upgrade OpenTelemetry to latest (java 1.62.0, instrumentation 2.28.1, semconv 1.41.1)

[lhotari]

Motivation

Keep the OpenTelemetry dependencies current and consistent.

PR #25779 ("Bump opentelemetry from 1.61.0 to 1.62.0") bumped the stable opentelemetry BOM version ref from 1.61.0 to 1.62.0, but it did not update the separate opentelemetry-alpha version ref, leaving it at 1.61.0-alpha. As a result the stable BOM (1.62.0) and the alpha BOM (1.61.0-alpha) were out of sync. This PR aligns the alpha version number with the stable release and upgrades the remaining OpenTelemetry components to their latest releases.

Modifications

Version catalog (gradle/libs.versions.toml):

Version ref	Before	After
opentelemetry	1.62.0	1.62.0 (already latest)
opentelemetry-alpha	1.61.0-alpha	1.62.0-alpha (aligned with stable; PR #25779 had left it behind)
opentelemetry-instrumentation	2.27.0	2.28.1
opentelemetry-instrumentation-alpha	2.27.0-alpha	2.28.1-alpha
opentelemetry-semconv	1.41.0	1.41.1
opentelemetry-gcp-resources	1.48.0-alpha	1.57.0-alpha

Distribution license files — updated bundled-jar versions to match the upgraded artifacts:

• distribution/server/src/assemble/LICENSE.bin.txt: api-incubator and exporter-prometheus → 1.62.0-alpha; the four instrumentation modules → 2.28.1/2.28.1-alpha; semconv → 1.41.1; gcp-resources → 1.57.0-alpha.
• distribution/shell/src/assemble/LICENSE.bin.txt: api-incubator → 1.62.0-alpha.

Preserve Prometheus exporter behavior (backward compatibility):

• OpenTelemetry 1.62.0 includes a breaking change — the Prometheus exporter's default server host changed from 0.0.0.0 to localhost. Pulsar configures the Prometheus exporter purely via OpenTelemetry autoconfiguration and never set the host, so after the upgrade the metrics endpoint would bind to localhost only and become unreachable from outside the local host (e.g. another container or a remote Prometheus scraper).
• OpenTelemetryService now supplies otel.exporter.prometheus.host=0.0.0.0 as a default, restoring the previous behavior. It remains overridable via the standard OTEL_EXPORTER_PROMETHEUS_HOST environment variable / otel.exporter.prometheus.host system property.

Verifying this change

• Make sure that the change passes the CI checks.

This change is a dependency upgrade verified as follows:

• All target artifact coordinates were confirmed to exist on Maven Central.
• ./gradlew :pulsar-opentelemetry:dependencies resolves with the expected version set (no conflicts); :pulsar-opentelemetry:compileJava/compileTestJava build cleanly against the upgraded instrumentation API.
• ./gradlew checkBinaryLicense passes for both the server and shell distributions, confirming the LICENSE.bin.txt files match the actually bundled jars. (com.google.cloud.opentelemetry:detector-resources-support:0.36.0 remains bundled — it is pulled transitively via org.apache.bookkeeper:stream-storage-java-client, not by gcp-resources — so its license entry is kept.)
• Added unit test OpenTelemetryServiceTest#testPrometheusExporterDefaultsToAllInterfacesHost for the Prometheus host default.
• Ran the OpenTelemetrySanityTest integration test (both testOpenTelemetryMetricsOtlpExport and testOpenTelemetryMetricsPrometheusExport) against a locally built distribution image — both pass with the fix.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment