Bump calcite to 1.36.0, add json-path constraint (deephaven#5181)

https://calcite.apache.org/news/2023/07/26/release-1.35.0/
https://calcite.apache.org/news/2023/11/10/release-1.36.0/

Fixes CVE-2023-51074

sql/build.gradle

@@ -8,7 +8,14 @@ description = 'The Deephaven SQL parser'
 
 dependencies {
  api project(':qst')
- implementation 'org.apache.calcite:calcite-core:1.34.0'
+ implementation 'org.apache.calcite:calcite-core:1.36.0'
+ constraints {
+ // This constraint can be removed once calcite-core has next release and we can
+ // pick up the fixed dependency transitively.
+ implementation('com.jayway.jsonpath:json-path:2.9.0') {
+ because 'json-path Out-of-bounds Write vulnerability, CVE-2023-51074'
+ }
+ }
 
  Classpaths.inheritImmutables(project)