[SPARK-54239][BUILD] Bump Guava 33.4.8

### What changes were proposed in this pull request?

This PR bumps Guava from 33.4.0 to 33.4.8, the latest patch version of 33.4 serial.

The release notes can be found at

- https://github.com/google/guava/releases/tag/v33.4.8
- https://github.com/google/guava/releases/tag/v33.4.1 (this contains more info)

As mentioned in the release notes, it migrates from jsr305 to jspecify, thus causes some transitive deps changes

https://mvnrepository.com/artifact/com.google.guava/guava/33.4.0-jre
https://mvnrepository.com/artifact/com.google.guava/guava/33.4.8-jre

```patch
- com.google.code.findbugs:jsr305:3.0.2
- org.checkerframework:checker-qual:3.34.0
+ org.jspecify:jspecify:1.0.0
```

Note, the transitive deps change does not affect the Maven package because we use the white list to declare the included deps for shaded jars.

### Why are the changes needed?

The current Guava 33.4.0 used by Spark was released in Dec 17, 2024. This upgrades it to the latest patched version (instead of 33.5.0) to make it align with gRPC 1.76.0 (this is not enforced, but nice to have)

https://mvnrepository.com/artifact/io.grpc/grpc-api/1.76.0

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Pass GHA.

### Was this patch authored or co-authored using generative AI tooling?

No.

Closes #52939 from pan3793/guava-33.4.8.

Authored-by: Cheng Pan <chengpan@apache.org>
Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>
(cherry picked from commit 9289c43)
Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>

Author: pan3793

dev/deps/spark-deps-hadoop-3-hive-2.3

@@ -62,12 +62,12 @@ derbyshared/10.16.1.1//derbyshared-10.16.1.1.jar
 derbytools/10.16.1.1//derbytools-10.16.1.1.jar
 dropwizard-metrics-hadoop-metrics2-reporter/0.1.2//dropwizard-metrics-hadoop-metrics2-reporter-0.1.2.jar
 esdk-obs-java/3.20.4.2//esdk-obs-java-3.20.4.2.jar
-failureaccess/1.0.2//failureaccess-1.0.2.jar
+failureaccess/1.0.3//failureaccess-1.0.3.jar
 flatbuffers-java/25.2.10//flatbuffers-java-25.2.10.jar
 gcs-connector/hadoop3-2.2.28/shaded/gcs-connector-hadoop3-2.2.28-shaded.jar
 gmetric4j/1.0.10//gmetric4j-1.0.10.jar
 gson/2.11.0//gson-2.11.0.jar
-guava/33.4.0-jre//guava-33.4.0-jre.jar
+guava/33.4.8-jre//guava-33.4.8-jre.jar
 hadoop-aliyun/3.4.2//hadoop-aliyun-3.4.2.jar
 hadoop-annotations/3.4.2//hadoop-annotations-3.4.2.jar
 hadoop-aws/3.4.2//hadoop-aws-3.4.2.jar

pom.xml

@@ -198,8 +198,8 @@
     <!-- org.apache.commons/commons-pool2/-->
     <commons-pool2.version>2.12.1</commons-pool2.version>
     <datanucleus-core.version>4.1.17</datanucleus-core.version>
-    <guava.version>33.4.0-jre</guava.version>
-    <guava.failureaccess.version>1.0.2</guava.failureaccess.version>
+    <guava.version>33.4.8-jre</guava.version>
+    <guava.failureaccess.version>1.0.3</guava.failureaccess.version>
     <gson.version>2.11.0</gson.version>
     <janino.version>3.1.9</janino.version>
     <jersey.version>3.0.18</jersey.version>

project/SparkBuild.scala

@@ -881,17 +881,17 @@ object SparkConnectJdbc {
     // Exclude `scala-library` from assembly.
     (assembly / assemblyPackageScala / assembleArtifact) := false,
 
-    // Exclude `pmml-model-*.jar`, `scala-collection-compat_*.jar`, `jsr305-*.jar`,
+    // Exclude `pmml-model-*.jar`, `scala-collection-compat_*.jar`, `jspecify-*.jar`,
     // `error_prone_annotations-*.jar`, `listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar`,
-    // `j2objc-annotations-*.jar`, `checker-qual-*.jar` and `unused-1.0.0.jar` from assembly.
+    // `j2objc-annotations-*.jar` and `unused-1.0.0.jar` from assembly.
     (assembly / assemblyExcludedJars) := {
       val cp = (assembly / fullClasspath).value
       cp filter { v =>
         val name = v.data.getName
         name.startsWith("pmml-model-") || name.startsWith("scala-collection-compat_") ||
-          name.startsWith("jsr305-") || name.startsWith("error_prone_annotations") ||
+          name.startsWith("jspecify-") || name.startsWith("error_prone_annotations") ||
           name.startsWith("listenablefuture") || name.startsWith("j2objc-annotations") ||
-          name.startsWith("checker-qual") || name == "unused-1.0.0.jar"
+          name == "unused-1.0.0.jar"
       }
     },
     // Only include `spark-connect-client-jdbc-*.jar`
@@ -971,17 +971,17 @@ object SparkConnectClient {
     // Exclude `scala-library` from assembly.
     (assembly / assemblyPackageScala / assembleArtifact) := false,
 
-    // Exclude `pmml-model-*.jar`, `scala-collection-compat_*.jar`, `jsr305-*.jar`,
+    // Exclude `pmml-model-*.jar`, `scala-collection-compat_*.jar`, `jspecify-*.jar`,
     // `error_prone_annotations-*.jar`, `listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar`,
-    // `j2objc-annotations-*.jar`, `checker-qual-*.jar` and `unused-1.0.0.jar` from assembly.
+    // `j2objc-annotations-*.jar` and `unused-1.0.0.jar` from assembly.
     (assembly / assemblyExcludedJars) := {
       val cp = (assembly / fullClasspath).value
       cp filter { v =>
         val name = v.data.getName
         name.startsWith("pmml-model-") || name.startsWith("scala-collection-compat_") ||
-          name.startsWith("jsr305-") || name.startsWith("error_prone_annotations") ||
+          name.startsWith("jspecify-") || name.startsWith("error_prone_annotations") ||
           name.startsWith("listenablefuture") || name.startsWith("j2objc-annotations") ||
-          name.startsWith("checker-qual") || name == "unused-1.0.0.jar"
+          name == "unused-1.0.0.jar"
       }
     },