Dependency updates to eliminate vulnerabilities discovered by dependency-check

Eliminated all CRITICAL and HIGH except for CVE-2016-1000027 (which more or less forbids the use of Spring since 2016 -- it's moderately controversial.

@road

cve-supressions.xml

-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-Documentation: https://jeremylong.github.io/DependencyCheck/general/suppression.html
--->
-<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <notes><![CDATA[Long discussion about this CVE by Spring: https://github.com/spring-projects/spring-framework/issues/24434]]></notes>
-        <packageUrl regex="true">^pkg:maven/org\.springframework/spring.*$</packageUrl>
-        <cve>CVE-2016-1000027</cve>
-    </suppress>
-</suppressions>
\ No newline at end of file