Scope gRPC dependencies and rely on grpc-bom for single version (#4784)

* Scope gRPC dependencies and rely on grpc-bom for single version

Replace the brittle `grpc-all` dependency (with its long exclusion list in
the parent pom) with the specific gRPC artifacts each module actually
uses. The `grpc-bom` import in dependencyManagement continues to enforce
a single version across all `io.grpc:*` artifacts.

Module changes:
- pom.xml: drop the `grpc-all` dependencyManagement block; the BOM alone
  manages versions
- stream/common: `grpc-all` -> `grpc-api`, `grpc-stub`, `grpc-core`
  (compile); `grpc-inprocess`, `grpc-util` (test)
- stream/tests-common: `grpc-all` -> `grpc-api`, `grpc-stub`; drop unused
  `grpc-testing` (no `io.grpc.testing.*` imports anywhere)
- stream/proto: drop `grpc-protobuf` (dead after the LightProto
  migration; generated code uses Netty `ByteBuf` only)
- stream/clients/java/base: add explicit `grpc-inprocess`,
  `grpc-netty-shaded`, `grpc-util` that were silently inherited
- metadata-drivers/etcd: `grpc-all` -> `grpc-api`, `grpc-stub`

Drop pointless protobuf-java usages so statelib no longer needs it:
- statelib `Bytes.toLong(ByteString)` was a dead overload (every caller
  uses the `byte[]` variant); removed
- statelib `MVCCStoreImpl` used `TextFormat.escapeBytes` once for an
  error message; replaced with JDK 17 `HexFormat.of().formatHex`
- bookkeeper-server `BookieImplTest` had two no-op protobuf
  round-trips (`ByteString.copyFrom(bytes).toByteArray()` and
  `unsafeWrap(...).asReadOnlyByteBuffer()`); replaced with plain
  `byte[]` and `ByteBuffer.wrap`

Update LICENSE-{all,server,bkctl}.bin.txt to match the new bundled jar
set: drop entries for grpc-all/-alts/-auth/-grpclb/-opentelemetry
/-protobuf/-protobuf-lite/-services/-testing/-xds/-rls
/-gcp-csm-observability and the transitively-removed proto-google-common
-protos, protobuf-java-util, api-common, google-http-client*,
google-auth-library-*, auto-value-annotations, re2j, opencensus-*,
conscrypt; clean up the orphaned source-URL footnotes.

Net dist change: 7 grpc jars (down from 18) and 1 protobuf jar
(down from 3, now sourced only via prometheus-metrics-exposition-formats).

* Fix LICENSE/NOTICE files for the dropped jars

CI's `dev/check-all-licenses` flagged remaining stale references that
were not caught in the previous commit:

- NOTICE-{all,server,bkctl}.bin.txt: drop the unbundled `grpc-all`,
  `grpc-auth`, `grpc-protobuf`, `grpc-protobuf-lite`, `grpc-testing`
  entries; add the previously-missing `grpc-api`, `grpc-inprocess`,
  `grpc-util` to the gRPC list (these have always been bundled).
- LICENSE-{all,server,bkctl}.bin.txt: drop
  `opentelemetry-gcp-resources-1.56.0-alpha.jar` (was transitive via the
  removed `grpc-gcp-csm-observability`, no longer bundled).
- LICENSE-bkctl.bin.txt: drop the entire OpenTelemetry SDK list and the
  protobuf-java entry; bkctl never bundled any of these (pre-existing
  staleness, hidden in CI by `set -e` stopping on the first dist error).
- bookkeeper-dist/src/assemble/{bin-all,bin-server,bkctl}.xml: drop the
  `deps/google-auth-library-credentials-0.20.0/LICENSE` include from
  every assembly (orphaned now that the jar is no longer bundled), and
  drop the `deps/protobuf/LICENSE` include from the bkctl assembly
  (bkctl doesn't ship protobuf-java).
- Delete the orphaned
  `bookkeeper-dist/src/main/resources/deps/google-auth-library-credentials-0.20.0/`
  directory.

Verified locally: `dev/check-all-licenses` passes against freshly-built
all/server/bkctl tarballs.