Remove commons-logging

Closes gh-10499

config/spring-security-config.gradle

@@ -81,6 +81,7 @@ dependencies {
 	testImplementation "org.mockito:mockito-inline"
 	testImplementation ('org.openid4java:openid4java-nodeps') {
 		exclude group: 'com.google.code.guice', module: 'guice'
+		exclude group: 'commons-logging', module: 'commons-logging'
 	}
 	testImplementation('org.seleniumhq.selenium:htmlunit-driver') {
 		exclude group: 'commons-logging', module: 'commons-logging'

dependencies/spring-security-dependencies.gradle

@@ -25,7 +25,6 @@ dependencies {
 		api "com.unboundid:unboundid-ldapsdk:4.0.14"
 		api "commons-codec:commons-codec:1.15"
 		api "commons-collections:commons-collections:3.2.2"
-		api "commons-logging:commons-logging:1.2"
 		api "io.mockk:mockk:1.12.1"
 		api "io.projectreactor.tools:blockhound:1.0.6.RELEASE"
 		api "javax.annotation:jsr250-api:1.0"

openid/spring-security-openid.gradle

@@ -16,6 +16,7 @@ dependencies {
 	// We use the maven central version here instead.
 	api('org.openid4java:openid4java-nodeps') {
 		exclude group: 'com.google.code.guice', module: 'guice'
+		exclude group: 'commons-logging', module: 'commons-logging'
 	}
 	api 'org.springframework:spring-aop'
 	api 'org.springframework:spring-beans'
@@ -26,7 +27,9 @@ dependencies {
 	provided 'javax.servlet:javax.servlet-api'
 
 	runtimeOnly 'net.sourceforge.nekohtml:nekohtml'
-	runtimeOnly 'org.apache.httpcomponents:httpclient'
+	runtimeOnly('org.apache.httpcomponents:httpclient') {
+		exclude group: 'commons-logging', module: 'commons-logging'
+	}
 
 	testImplementation "org.assertj:assertj-core"
 	testImplementation "org.junit.jupiter:junit-jupiter-api"