Make javax.servlet 2.5 a provided dependency 

When running in a servlet 3.0 environment (jetty 8+) we run into the following security exception as the signer for javax.servlet 2.5 and javax.servlet 3.0 differ (at least in the case of Jetty):

    Exception in thread "main" java.lang.SecurityException: class "javax.servlet.AsyncContext"'s signer information   does not match signer information of other classes in the same package

By making the dependency provided we use the underlying container's or adapter's version, which is what we want (of course as long javax.servlet remains backwards compatible with 2.5)