Make commons-fileupload an explicit core dependency (rather than indirect via the plugin API)