bump commons-io due to security vulnerabilities in that library

[ryber]

Hello, this just bumps the commons-IO version. I have a black duck scan that identified two vulnerabilities in this version of IO:

Apache Commons IO contains a flaw that allows traversing outside of a restricted path. The issue is due to FileNameUtils.normalize not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can disclose arbitrary files.

and

Apache Commons IO contains a flaw that is due to the program failing to restrict which class can be serialized. This may allow a remote attacker to execute arbitrary Java code via deserialization methods.

The version I bumped it to has no known vulnerabilities (for now)

[lbalmaceda]

thanks!