Force a more recent version of log4j as a jar dependency

The log4j has distributed some bad packages in the past but this release looks
safe to include