Upgrade pax-url-aether to 1.6.0.

Since our jenkins uses mirrors with passwords,
we needed a fix for https://ops4j1.jira.com/browse/PAXURL-217
in order to run osgi.test on jenkins, now that we use maven more.
We didn't hit this bug before because we were using a standard
location for the maven local repository, but that causes problems
with concurrent jenkins jobs accessing it.