build(deps): bump zk version to fix cve

[nozjkoitop]

Description

Upgrade ZooKeeper from 3.8.6 to 3.8.7 to address five security vulnerabilities

• CVE-2026-59739: ACL-restricted znode path disclosure during watch reconnection.
• CVE-2026-79993: Unauthorized deletion of empty znodes through the deleteContainer opcode.
• CVE-2026-59969: Missing peer hostname verification in FIPS-mode quorum TLS.
• CVE-2026-84439: Audit-log field injection.
• CVE-2026-84501: Operational-log forgery through crafted ensemble authentication names.

Keeps zookeeper-jute aligned and updates licenses.yaml.

Release note

Updated the bundled ZooKeeper dependency to 3.8.7. Independently deployed ZooKeeper servers require a separate upgrade.

---

This PR has:

• been self-reviewed.
• a release note entry in the PR description.
• added or updated version, license, or notice information in licenses.yaml.

This PR has:

• been self-reviewed.
• added documentation for new or modified features or behaviors.
• a release note entry in the PR description.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.