Bump commons dependencies, clean up POM

Bump commons dependencies, clean up POM

Explicitly pull in beanutils 1.9.3 in aaa-shiro, and clean up the
dependencies to pull in dependencies transitively. The generated
feature ends up being identical, apart from beanutils and
commons-logging (upgraded to 1.2, which is now an OSGi bundle).

beanutils’ release notes are available at
https://commons.apache.org/proper/commons-beanutils/changes-report.html

Change-Id: I4fe725c6d4b443e0c3be3cbdd662a27a7ca7c719
Signed-off-by: Stephen Kitt <skitt@redhat.com>