properly handles commons-beanutils to 1.11.0 fixes CVE-48734 (#3925) (#3928)

* force beanUtils to 2.0



* properly handles commons-beanutils to 1.11.0

tested locally with  ./gradlew :opensearch-ml-algorithms:dependencyInsight --dependency commons-beanutils --configuration runtimeClasspath



---------


(cherry picked from commit d47ba65)

Signed-off-by: Brian Flores <iflorbri@amazon.com>
Co-authored-by: Brian Flores <iflorbri@amazon.com>

Author: opensearch-trigger-bot[bot]

ml-algorithms/build.gradle

@@ -99,10 +99,16 @@ configurations.all {
     resolutionStrategy.force 'com.google.protobuf:protobuf-java:3.25.5'
     resolutionStrategy.force 'org.apache.commons:commons-compress:1.26.0'
     resolutionStrategy.force 'software.amazon.awssdk:bom:2.30.18'
-    resolutionStrategy.force 'org.apache.commons:commons-beanutils:2.0.0'
+    resolutionStrategy.eachDependency { DependencyResolveDetails details ->
+        if (details.requested.group == 'commons-beanutils') {
+            details.useVersion '1.11.0'
+        }
+        if (details.requested.group == 'org.apache.commons' && details.requested.name == 'commons-beanutils2') {
+            details.useVersion '2.0.0-M2'
+        }
+    }
 }
 
-
 jacocoTestReport {
     reports {
         xml.getRequired().set(true)