SAML: mark log4j-over-slf4j as test scope and remove unused javax.servlet dependency

Glad we had an RC since it helped me find this bug :-)  Thought I fixed that slf4j problem everywhere, but looks like I missed one. Hopefully I'll be able to upgrade my Jenkins plugin to use the RC now. Also submitted a pull request to https://github.com/mesosphere/chaos to use shiro and the pac4j RC, so we'll see how that goes (Chaos is the framework that Marathon and Chronos are built on)