It turns out that the httpclient version mismatch wasn't the actual problem. Since httpclient 4 and httpclient 5 are in different namespaces, no shading was required there.
The actual problem was the spring version mismatch caused by the spring-boot version bump. That's what I needed to address.
At first, I tried to shade org.springframework in the root project's pom.xml (let's call the root project Qux). However, I eventually realized that it wasn't possible to do so because I can't have both spring-boot 2 and spring-boot 3 on the same classpath. Therefore, either Qux would fail because spring-boot 2 was on the classpath or Foo would fail because spring-boot 3 was on the classpath, and all my shading was in vain.
Finally, I realized that I have to perform the shading in Foo's pom.xml. Since I didn't have direct access to Foo's source code, I created 2 new modules via IntelliJ: a parent one and Bar. Bar has a dependency on Foo. I shaded org.springframework in Bar's xml. In the parent pom.xml, I added Bar and Qux to the section. Now, everything works like a charm.