[9.3] (backport #455) Ship ONLY httpclient5 5.6.1

[mergify]

The shadow jar task merges two dependency sources: a fileTree copy of jars from the ES source build (elasticsearchMinimalCore) and Maven-resolved dependencies from elasticsearch-java (elasticsearchClient). Because elasticsearchMinimalCore is listed first, its httpclient5-5.5.jar from x-pack-core takes precedence over the patched httpclient5-5.6.1.jar resolved via Maven from elasticsearch-java 9.4.0.

Exclude httpclient5, httpcore5, and httpcore5-h2 from the x-pack-core module copy so the Maven-resolved versions are the sole source. This ensures the plugin ships the patched httpclient5 5.6.1 regardless of what version the ES server source build bundles.

Related:

• Adopt latest patch release for http client elasticsearch-java#1227
• Upgrade httpclient5 to 5.6.1 and httpcore5 to 5.4 elasticsearch#148345

Thanks for contributing to Logstash! If you haven't already signed our CLA, here's a handy link: https://www.elastic.co/contributor-agreement/

---

This is an automatic backport of pull request #455 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of aac830c has failed:

On branch mergify/bp/9.3/pr-455
Your branch is up to date with 'origin/9.3'.

You are currently cherry-picking commit aac830c.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   build.gradle

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   CHANGELOG.md

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[mashhurs]

LGTM with happy CI

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 2f418fc

cc @donoghuc