html.validator: Remove dependency on log4j

[matthiasblaesing]

This commit modifies the patched version of the html.validator not to rely on log4j anymore.

There is no security gain estimated. This commit exists only to silence "security" teams, that have some strange interpretation of security. They assume, that you can deduce from the presence of a dependency/ library, whether or not there is a security problem. There is no evidence, that any of the CVEs against log4j 1 apply here.

[matthiasblaesing]

This PR is currently for only for review. Before merge the binary will be moved to the OSUOL server.

[mbien]

patch looks good. An alternative approach for something like this could be to use SLF4J bridges, since the project has a bridge for almost everything. In this particular case:

log4j-over-slf4j + slf4j-jdk14

this would map log4j 1 to slf4j and use the weirdly named slf4j-jdk14 impl as "logging impl", which is actually a bridge to java.util.logging.

https://www.slf4j.org/legacy.html#log4j-over-slf4j +
https://www.slf4j.org/manual.html#projectDep (scrolll down to slf4j-jdk14)

edit:
link to upstream issue: validator/validator#1313

[matthiasblaesing]

@mbien ah - nice idea. Would be good to consider if we can get the patching down or updated.

[junichi11]

Looks good!

[matthiasblaesing]

Pushed new binary to the OSUOSL server and updated the reference. Will merge tomorrow once tests are green.