Add notes on how Hadoop auth is used

code-style/dependency-check-suppressions.xml

@@ -231,6 +231,12 @@
 
         Since HDFS is not used, it doesn't seem like this should be needed as a dependency. We can look at removing this
         from the classpath.
+
+        We're using Hadoop for our integration with Parquet, and for bulk import jobs on Spark. The Parquet integration
+        only talks to S3 in practice, although the Hadoop integration is designed for HDFS, which may be why this is a
+        dependency. Spark also seems to only use Hadoop authentication when talking to HDFS:
+
+        https://spark.apache.org/docs/latest/security.html#kerberos
         ]]></notes>
         <packageUrl regex="true">^pkg:maven/org\.jboss\.xnio/xnio\-api@.*$</packageUrl>
         <vulnerabilityName>CVE-2023-5685</vulnerabilityName>