Upgrade pax-url-aether to 1.6.0.

Since our jenkins uses mirrors with passwords,
we needed a fix for https://ops4j1.jira.com/browse/PAXURL-217
in order to run osgi.test on jenkins, now that we use maven more.
We didn't hit this bug before because we were using a standard
location for the maven local repository, but that causes problems
with concurrent jenkins jobs accessing it.

Also, upgrade STARR because Jenkins is using `skip.locker` now.

See https://groups.google.com/d/msg/scala-internals/7R-Y5txP8NI/DX_JWFO2fu4J
for a discussion of the problem this should fix.