Update Velocity from 1.5 to 2.3. Fixes #4078 / CVE-2020-13936

[tfmorris]

Fixes #4078. Resolves CVE-2020-13936

Changes proposed in this pull request:

• Update Apache Velocity from 1.5 to 2.3
• Set properties for maximum 1.x compatibility per version upgrade notes
  https://velocity.apache.org/engine/2.0/upgrading.html

[wetneb]

Thanks!

[wetneb]

@tfmorris it seems that this is causing incompatibility problems for extensions, see #6581

[thadguidry]

@wetneb maybe we just need to check the new dependency requirements below? Because @tfmorris forgot about them, or missed that part...

He did this...

For busy people: To maximize backward compatibility with Velocity 1.x, be sure to include the following lines in your Velocity configuration:

runtime.conversion.handler = none
space.gobbling = bc
directive.if.emptycheck = false

But forgot this...

and check the Dependency changes below.

• commons-collections and commons-logging aren't needed any more at runtime.
• there's a new runtime dependency, slf4j-api 1.7.25.
• you'll need an SLF4J binding.