build(deps): Bump Iceberg from 1.11.0 to 1.12.0

[ferenc-csaky]

What does this change?

Bumps Iceberg from 1.11.0 to 1.12.0. Supersedes #409, which only changed iceberg.version.

• Switch iceberg-flink-runtime-2.1 → iceberg-flink-runtime-2.3 (runner + stdlib-iceberg) to match Flink 2.3.0
• Bump awssdk.version from 2.44.4 to 2.54.17 to stay in sync with the AWS SDK bundled in iceberg-aws-bundle 1.12.0 (awssdk-bom in Iceberg's libs.versions.toml @ apache-iceberg-1.12.0)

Area

• Runner CLI and Docker image (flink-sql-runner)
• Connectors (connectors)
• Formats (formats)
• Function libraries (stdlib)
• Environment utilities (env-utils)
• Tests and samples (testing)
• Build / CI / dependencies
• Docs (README.md, stdlib-docs)

How did you test it?

mvn clean install -Pci locally: all modules build and the image now ships iceberg-flink-runtime-2.3-1.12.0.jar and iceberg-aws-bundle-1.12.0.jar. All unit tests and ITs pass except KafkaSourceWatermarkIT.givenSparseKafkaSourceWatermark_whenIdleAdvanceDisabled_thenWatermarkDoesNotCloseWindow, which also fails locally on unmodified main (awaitility during(5s).atMost(6s) timing), so it's unrelated to this change.

Checklist

• The PR title starts with a type such as feat:, fix: or docs:, optionally with a scope (e.g. fix(flexible-json):)
• mvn clean install passes locally and the code is formatted with mvn spotless:apply
• New or changed behavior is covered by tests (given_when_then naming, AssertJ assertions)
• New dependency and plugin versions are defined as properties in the root pom.xml
• Commits are signed off and signed (git commit -s -S)
• README.md and stdlib-docs are updated if user-facing behavior or functions changed

🤖 Generated with Claude Code