Jcl enforcement

So having commons-logging in our dependency hierarchy is a bad thing. It doesn't get pulled into the log4j2 logs for some reason.

This pull request adds enforcement banning the commons-logging dependency (including transitively) and has a whole pile of commits to exclude all commons-logging and replace them with the jcl-over-slf4j bridge.

It's possible I missed a couple projects that need to have the bridge, because the spring dependency is managed and the replacing of a dependency is not manage-able :(