Added dependency management for spring-expression.

spring-expression is transitive through ows, which is transitive through
spring-security, which depends on a version different than what geoserver
depends no. Because the geoserver dependencies are provided we don't inherit
the dependency management that deals with this issue.