Remove transitive commons-logging dependencies

We use slf4j instead; jcl-over-slf4j needs to be a compile-time dependency because we use it in several classes. Unfortunately Maven does not have a way to exclude commons-logging globally, so we need to figure out which dependencies include it through `mvn dependency:tree` and specify an `<exclusion>` for each of them. Finally, we upgrade to slf4j 1.7.12: http://www.slf4j.org/news.html.

Author: praseodym

openid-connect-common/pom.xml

@@ -31,6 +31,12 @@
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-core</artifactId>
+<exclusions>
+<exclusion>
+<groupId>commons-logging</groupId>
+<artifactId>commons-logging</artifactId>
+</exclusion>
+</exclusions>
 </dependency>
 <dependency>
 <groupId>org.springframework</groupId>

openid-connect-server-webapp/pom.xml

@@ -94,6 +94,12 @@
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-orm</artifactId>
+<exclusions>
+<exclusion>
+<groupId>commons-logging</groupId>
+<artifactId>commons-logging</artifactId>
+</exclusion>
+</exclusions>
 </dependency>
 <dependency>
 <groupId>org.slf4j</groupId>

pom.xml

@@ -70,7 +70,7 @@
 
 <properties>
 <java-version>1.7</java-version>
-<org.slf4j-version>1.7.7</org.slf4j-version>
+<org.slf4j-version>1.7.12</org.slf4j-version>
 </properties>
 <description>A reference implementation of OpenID Connect (http://openid.net/connect/), OAuth 2.0, and UMA built on top of Java, Spring, and Spring Security. The project contains a fully functioning server, client, and utility library.</description>
 <url>https://github.com/mitreid-connect</url>
@@ -353,7 +353,6 @@
 <groupId>org.slf4j</groupId>
 <artifactId>jcl-over-slf4j</artifactId>
 <version>${org.slf4j-version}</version>
-<scope>runtime</scope>
 </dependency>
 <dependency>
 <groupId>org.slf4j</groupId>
@@ -510,6 +509,10 @@
 <groupId>org.slf4j</groupId>
 <artifactId>slf4j-jdk14</artifactId>
 </dependency>
+<dependency>
+<groupId>org.slf4j</groupId>
+<artifactId>jcl-over-slf4j</artifactId>
+</dependency>
 <dependency>
 <groupId>javax.servlet</groupId>
 <artifactId>servlet-api</artifactId>