REP-946 Upgrade to Log4j 2.x

dependency managing something doesn't make it a dependency of everything it just forces the scope and version number of any dendencies.