build: use apache-commons-compress-1.4.1

apache-common-compress-1.3 produces invalid tarballs with nulls at suffix.

Change-Id: I7d75dcc3c7ca94118afee80bfa5b4eff629ee7da
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>