Dependency updates to eliminate vulnerabilities discovered by dependency-check

Eliminated all CRITICAL and HIGH except for CVE-2016-1000027 (which more or less forbids the use of Spring since 2016 -- it's moderately controversial.

@road

uw-spring-security-sample-war/src/main/java/edu/wisc/uwss/sample/configuration/DemonstrationOnlyPreAuthenticationConfiguration.java

@@ -96,7 +96,11 @@ public class DemonstrationOnlyPreAuthenticationConfiguration {
           HttpServletRequest httpRequest = (HttpServletRequest) request;
           String uri = httpRequest.getRequestURI();
           String param = httpRequest.getParameter("_ignorepreauth");
-          logger.debug("uri={}, param={}", uri, param);
+
+          // remove CRLF to avoid CWE-93
+          String cleanUri = (uri!=null) ? uri.replaceAll("([\\r\\n])", " ") : null;
+          String cleanParam = (param!=null) ? param.replace("([\\r\\n])","") : null;
+          logger.debug("uri={}, param={}", cleanUri, cleanParam);
           if(null != param || IGNORED.contains(uri)) {
             logger.info("skipping PreAuthenticationSimulationServletFilter, either due to '_ignorepreauth' or visiting ignore uri");
             filterChain.doFilter(request, response);