REP-946 Upgrade to Log4j 2.x

don't scope them at test at the top level, just don't scope them at all. Put them in the dependency management section so we can control version, but that's it.