first part of hardening the pom.xml file

We still trust repo.maven.apache.org, however
there is now no other external libraries defined.