Apache Pulsar 4.2.1

[fix][sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636) (#25569)
[fix][sec] Upgrade Jetty to address CVE-2026-2332 (#25527)
[fix][sec] Upgrade Jetty to address CVE-2026-5795 (#25532)
[fix][sec] Upgrade to async-http-client 2.14.5 to address CVE-2026-40490 (#25546)
[fix][sec] Upgrade to Netty 4.1.132.Final to address CVEs (#25399)
[fix][sec] Upgrade log4j to 2.25.4 to address CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34481
[fix] Upgrade Jetty to 12.1.6 to fix CVE-2026-1605 (#25485)

[fix][broker] Change the schema incompatible log from ERROR to WARN level (#25483)
[fix][broker] Fix backlog clearing for unloaded namespace bundles (#25272)
[fix][broker] Lower log level of DrainingHashesTracker not-found entry to DEBUG (#25558)
[fix][broker] Prevent timed-out producer creation from racing with retry (#25460)
[fix][broker] pulsar admin stats internal with metadata command (#25557)
[fix][broker] Revert "[improve][broker] Enhance advertised address resolution with fallback to localhost (#25238)" (#25523)
[fix][broker] Unthrottle producers immediately when publish rate limiting is disabled (#25502)
[fix][broker]Namespaces can be created with may empty replication_clusters policy (#25551)
[fix][admin] Refactor namespace migration operation to async in rest api (#25478)
[improve][broker] Close connection when close consumer write fails (#25520)
[improve][broker] Use full bundle name for namespace bundle destination affinity in ModularLoadManagerImpl (#25518)

[fix][client] Fix thread-safety and refactor MessageCryptoBc key management (#25400)

[fix][io] Restore lz4 compression with Kafka IO connector after #25198 exclusion

[improve][common] Optimize TopicName.get() to reduce lock contention on cache lookup (#25367)
[improve][broker] Improve the performance of TopicName constructor (#24463)

[fix][ci] Ensure discard_max_bytes is set to 0 only for existing block devices (#25510)
[fix][test] Extend SameAuthParamsLookupAutoClusterFailoverTest phase timeouts (#25563)
[fix][test] Fix flaky BrokerRegistryIntegrationTest port binding race (#25463)
[fix][test] Fix flaky ExtensibleLoadManagerImpl client reconnection tests: PulsarClientException$AlreadyClosedException: Client already closed (#25509)
[fix][test] Fix flaky ExtensibleLoadManagerTest.startBroker timeout (#25500)
[fix][test] Fix flaky OffloadPrefixTest.testPositionOnEdgeOfLedger race with ledger rollover (#25561)
[fix][test] Fix flaky ServerCnxTest.testCreateProducerTimeoutThenCreateSameNamedProducerShouldFail (#25497)
[fix][test] Fix flaky testLoadBalancerServiceUnitTableViewSyncer (#25427)
[fix][test] Flaky SameAuthParamsLookupAutoClusterFailoverTest (#25566)
[fix][test] Recreate EventLoop in PublishRateLimiterTest setup (#25560)
[fix][test] Relax BrokerRegistryIntegrationTest broker-close threshold (#25562)
[improve][ci] Cleanup tune-runner-vm and clean-disk actions (#25444)
[cleanup][ci] Remove documentation label bot (#25469)
[cleanup][ci] Remove ready-to-test label enforcement (#25470)
[cleanup][build] Bumped version to 4.2.1-SNAPSHOT
[fix][build][branch-4.2] Use correct Jetty ee8 BOM coordinates
[improve][ci] Backport fix for ssh-access action