Update guava >=24.1.1

We should update Guava in hbase-thirdparty to stop shipping the code cited as vulnerable in CVE-2018-10237. We do not invoke this code ourselves and users would have to try pretty hard to use it themselves, but we've seen more strange things before

Let's just bump up the dependency and move on.