[SPARK-37090] Upgrade libthrift to avoid security vulnerabilities

[juliuszsompolski]

What changes were proposed in this pull request?

Upgrade libthrift dependency from 0.12.0 to 0.15.0

Why are the changes needed?

https://snyk.io/vuln/maven:org.apache.thrift%3Alibthrift lists a couple of high-impact vulnerabilities of libthrift 0.12.0, in particular

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13949
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205

Keep the library up to date to fix vulnerabilities.

Does this PR introduce any user-facing change?

No.

How was this patch tested?

Existing tests.

[SparkQA]

Test build #144517 has finished for PR 34361 at commit f9a5c60.

• This patch fails to build.
• This patch merges cleanly.
• This patch adds no public classes.

[srowen]

See #34280 - Hyukjin already tried this. We can close this an the JIRA as a dupe.

[SparkQA]

Kubernetes integration test unable to build dist.

exiting with code: 1
URL: https://amplab.cs.berkeley.edu/jenkins/job/SparkPullRequestBuilder-K8s/48988/

[AmplabJenkins]

Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder-K8s/48988/

[juliuszsompolski]

Thanks @srowen for pointing this out.
@wangyum would you open https://github.com/apache/spark/compare/master...wangyum:thrift-0.15?expand=1 as PR?