[FLINK-39283][Formats/avro] Upgrade org.apache.avro:avro to 1.12.1

[snuyanzin]

What is the purpose of the change

as mentioned source (https://avro.apache.org/blog/2025/10/16/avro-1.12.1/)

Security Fixes

This release addresses 4 security fixes:

Prevent class with empty Java package being trusted by SpecificDatumReader (#3311)
Remove the default serializable packages and deprecated the property to introduce org.apache.avro.SERIALIZABLE_CLASSES instead (#3376)
java-[key-]class allowed packages must be packages (#3453)
AVRO-4053: doc consistency in velocity templates (#3150)

Brief change log

pom and NOTICE files

Verifying this change

existing tests

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): (yes )
• The public API, i.e., is any changed class annotated with @Public(Evolving): ( no)
• The serializers: (no)
• The runtime per-record code paths (performance sensitive): (no )
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: (no )
• The S3 file system connector: (no)

Documentation

• Does this pull request introduce a new feature? ( no)
• If yes, how is the feature documented? (not applicable)

[flinkbot]

CI report:

• 2e381f1 Azure: FAILURE

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build