Remove dependency on log4j 1.2.17
The platform these days mainly uses slf4j and logback for logging but due to legacy code, there are still dependencies on log4j 1.2.17.
The best thing to do is get rid of log4j entirely if possible.
The end result of this work was that all Simantics codebase references to log4j were removed but the org.simantics.sdk.feature still includes the org.apache.log4j
version 1.2.17 bundle just to make it a part of the SDK P2 repository so that it can be used by other features if absolutely necessary. None of those features that should actually be included as part of products include the log4j bundle anymore.
The platform repository changes are currently only in master, not 1.43.0 or 1.44.0. To get rid of the POI log4j dependency, the third-party repository must also be modified from 1.43.0 separately. Because of this, let's do these changes for release/1.43.1, not for 1.43.0. We can't cherry-pick the master changes to third-party for 1.43.0 due to Java11 changes.
Note that Apache POI 5.1.0 started embedding Log4j2 v2.14.0, which has CVE-2021-44228 and is not to be used as such. POI 5.1.0 is a definite no go.