READLY-124 Add BOMs and clean up all dependencies

[MatthewRyanRead]

• Move all third-party dependency pins to alchemy-dependencies
• Create alchemy-bom so other projects can just import it instead of pinning each Alchemy library
• Remove Maven shading because it is increasing the artifact size and prevents appropriately overriding the dependency versions
• Bump Dropwizard to the latest 1.3.x
• Bump Jetty to the latest 9.4.x
• Bump HK2 to the latest 2.5.x
• Bump Guice to 5.1.0
• Bump Guava to the latest version
• Bump several minor dependencies
• Use the BOMs provided by major dependencies, where available
• Run dependency:analyze-only during the build and dependency-analyze on the PR check to ensure all dependencies are explicit
• Replaced Findbugs/Checkstyle with Spotbugs
  • Not being enforced yet, since it has caught a lot more — it's just logging
• Fix issues found by the newer EqualsVerifier
• Replace Codahale (DW Metrics v3) with DW Metrics v4
• Add Dependabot config

This was tested via a regression on our internal Alchemy service, with no issues found.

[rdlf0]

Cool!