match geoserver dependencies and remove dead mortbay repo

The mortbay repository is no longer functioning (generating a placeholder page which is saved as a jar corrupting the local repository).

Also updated xstream dependency to match geoserver