CI hardening: pin Spark installer deps and replace EOL Neo4j 4.1 test image

[lmeyerov]

Tracking issue for CI supply-chain hardening: pin Spark test deps via lock+hash and replace/pin old Neo4j 4.1 test image (EOL). See PR #1318 follow-up.