refactor(commons): handle sofa-rpc desc type & mark TODO

[imbajin]

Purpose of the PR

• fix a deserialization vulnerability (CVE) was detected in SOFA-RPC (disable it by default now)

Main Changes

Test it in local env first:

1. run hugegraph-commons/hugegraph-rpc/src/test/java/org/apache/hugegraph/unit/UnitTestSuite.java

Before (5.7.6)

After (5.12.0)

Does this PR potentially affect the following parts?

• Dependencies (add/update license info & regenerate_dependencies)
• Modify configurations
• The public API
• Other affects (typed here)
• Nope

[imbajin]

Keep the dependencies for future upgrade refer:

   <!-- for pom.xml in rpc  module -->
    <dependencies>
        <!-- hugegraph-common -->
        <dependency>
            <groupId>org.apache.hugegraph</groupId>
            <artifactId>hugegraph-common</artifactId>
            <version>${revision}</version>
        </dependency>

        <!-- sofa rpc -->
        <dependency>
            <groupId>com.lmax</groupId>
            <artifactId>disruptor</artifactId>
            <version>3.3.7</version>
        </dependency>
        <dependency>
            <groupId>com.alipay.sofa</groupId>
            <artifactId>bolt</artifactId>
            <version>1.6.2</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-api</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>com.alipay.sofa</groupId>
            <artifactId>sofa-rpc-all</artifactId>
            <version>5.7.6</version>
            <exclusions>
                <exclusion>
                    <groupId>org.jboss.resteasy</groupId>
                    <artifactId>resteasy-client</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.jboss.resteasy</groupId>
                    <artifactId>resteasy-netty4</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.jboss.resteasy</groupId>
                    <artifactId>resteasy-jackson2-provider</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.httpcomponents</groupId>
                    <artifactId>httpclient</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.httpcomponents</groupId>
                    <artifactId>httpcore</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.httpcomponents</groupId>
                    <artifactId>httpmime</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.jboss.logging</groupId>
                    <artifactId>jboss-logging</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.grpc</groupId>
                    <artifactId>grpc-core</artifactId>
                </exclusion>
<!--                <exclusion>-->
<!--                    <groupId>io.grpc</groupId>-->
<!--                    <artifactId>grpc-all</artifactId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>jackson-annotations</artifactId>-->
<!--                    <groupId>com.fasterxml.jackson.core</groupId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>jackson-core</artifactId>-->
<!--                    <groupId>com.fasterxml.jackson.core</groupId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>jackson-databind</artifactId>-->
<!--                    <groupId>com.fasterxml.jackson.core</groupId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>netty-all</artifactId>-->
<!--                    <groupId>io.netty</groupId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>commons-lang3</artifactId>-->
<!--                    <groupId>org.apache.commons</groupId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>protobuf-java</artifactId>-->
<!--                    <groupId>com.google.protobuf</groupId>-->
<!--                </exclusion>-->
            </exclusions>
        </dependency>
        <dependency>
            <groupId>io.grpc</groupId>
            <artifactId>grpc-core</artifactId>
            <version>1.28.1</version>
<!--            <exclusions>-->
<!--                <exclusion>-->
<!--                    <artifactId>jackson-core</artifactId>-->
<!--                    <groupId>com.fasterxml.jackson.core</groupId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>guava</artifactId>-->
<!--                    <groupId>com.google.guava</groupId>-->
<!--                </exclusion>-->
<!--            </exclusions>-->
        </dependency>
    </dependencies>

---

for server-api module

<groupId>org.apache.hugegraph</groupId>
            <artifactId>hugegraph-core</artifactId>
            <version>${revision}</version>
            <exclusions>
                <exclusion>
                    <artifactId>bolt</artifactId>
                    <groupId>com.alipay.sofa</groupId>
                </exclusion>
<!--                <exclusion>-->
<!--                    <artifactId>hessian</artifactId>-->
<!--                    <groupId>com.alipay.sofa</groupId>-->
<!--                </exclusion>-->
                <exclusion>
                    <artifactId>guava</artifactId>
                    <groupId>com.google.guava</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>netty-all</artifactId>
                    <groupId>io.netty</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>sofa-common-tools</artifactId>
                    <groupId>com.alipay.sofa.common</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>hessian</artifactId>
                    <groupId>com.alipay.sofa</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>jackson-databind</artifactId>
                    <groupId>com.fasterxml.jackson.core</groupId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>

@@ -41,36 +71,68 @@
            <!-- Keep consistent with grpc dependency version (pd/store) -->
<!--            <version>1.47.0</version>-->
            <version>1.39.0</version>
            <exclusions>
                <exclusion>
                    <artifactId>guava</artifactId>
                    <groupId>com.google.guava</groupId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>org.apache.hugegraph</groupId>
            <artifactId>hugegraph-rpc</artifactId>
<!--            <exclusions>-->
<!--                <exclusion>-->
<!--                    <groupId>io.grpc</groupId>-->
<!--                    <artifactId>grpc-netty-shaded</artifactId>-->
<!--                </exclusion>-->
<!--                &lt;!&ndash; conflict with jraft &ndash;&gt;-->
<!--                <exclusion>-->
<!--                    <groupId>com.alipay.sofa</groupId>-->
<!--                    <artifactId>bolt</artifactId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <groupId>com.alipay.sofa.common</groupId>-->
<!--                    <artifactId>sofa-common-tools</artifactId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <groupId>com.alipay.sofa</groupId>-->
<!--                    <artifactId>hessian</artifactId>-->
<!--                </exclusion>-->
<!--                &lt;!&ndash; conflict with cassandra-netty/tinkerpop-server  &ndash;&gt;-->
<!--                <exclusion>-->
<!--                    <groupId>io.netty</groupId>-->
<!--                    <artifactId>netty-all</artifactId>-->
<!--                </exclusion>-->
<!--                <exclusion>-->
<!--                    <artifactId>okio</artifactId>-->
<!--                    <groupId>com.squareup.okio</groupId>-->
<!--                </exclusion>-->
<!--            </exclusions>-->
        </dependency>
        <dependency>
            <groupId>com.alipay.sofa</groupId>
            <artifactId>bolt</artifactId>
            <version>1.6.6</version>
            <scope>compile</scope>
            <exclusions>
                <exclusion>
                    <artifactId>netty-all</artifactId>
                    <groupId>io.netty</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>sofa-common-tools</artifactId>
                    <groupId>com.alipay.sofa.common</groupId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
          <groupId>io.netty</groupId>
          <artifactId>netty-all</artifactId>
          <version>4.1.44.Final</version>
          <scope>compile</scope>
        </dependency>