replace some maven target components by Orbit?

[Bananeweizen]

Description

Use more artifacts from Orbit instead of Maven

Motivation

When the Maven components in TPD were finally supported, I was a big proponent of using them, because they were more up-to-date then Orbit. By now, Orbit components are typically up-to-date on their own, and we might rather start adding secondary versions of components to the release train due to not being up-to-date in our dependencies.tpd. That's why I'm wondering if we should replace some of them by Orbit again. E.g. all the bouncycastle or Apache libs are the same or more recent in Orbit.
Or am I missing something in the general workflow for release train aggregation or similar that would prohibit this?

Alternatives considered

No response

Additional context

No response

[msohn]

In jgit we have to also update the maven dependencies in pom.xml and the bazel dependencies in WORKSPACE