Update commons-lang3 to 3.17.0

[manofthepeace]

Draft until 3.17.0 actually exists.

Fixes: #42686

Looks like the dust settled on this and 3.17 will be OK

When compared to 3.14, 3 new singleton instances are available;

Random*Utils.secure() that uses SecureRandom()
Random*Utils.secureStrong() that uses SecureRandom.getInstanceStrong()
Random*Utils.insecure() that uses ThreadLocalRandom as 3.14 was using

This PR uses insecure() to have the same behaviour as 3.14.

I personally do not think it is worthwhile to get rid of RandomStringUtils because a mistake happened in the lib, these things happen.

[famod]

Thanks for taking an early stab at this.

AFAICS, this will have to wait (also) for Liquibase 4.29.2 to land in Quarkus: liquibase/liquibase#6179

Furthermore, there is still the potential issue of other libs not using the new singleton instances / factory methods yet.

[gsmet]

Yeah, so just to be clear: this won't be for either 3.14 or 3.15.

But we can merge in main as it's going to be for 3.16 as soon as the Liquibase update lands.

[manofthepeace]

At least in 3.17, using Random*Utils.random() will use secure and not secureStrong so it should not be draining the system's entropy pool. Might not play well with native though.

[famod]

@manofthepeace so they also restored all the old >= 3.14.0 methods to not use the "strong" approach?
If that's the case we could merge earlier, but then again there is no hurry and better to be save than sorry.

[manofthepeace]

Yes this is what I could gather by comparing the source of both 3.14 and 3.17 so;

3.14:
https://github.com/apache/commons-lang/blob/rel/commons-lang-3.14.0/src/main/java/org/apache/commons/lang3/RandomUtils.java
https://github.com/apache/commons-lang/blob/rel/commons-lang-3.14.0/src/main/java/org/apache/commons/lang3/RandomStringUtils.java

3.17:
https://github.com/apache/commons-lang/blob/commons-lang-3.17.0-RC1/src/main/java/org/apache/commons/lang3/RandomUtils.java
https://github.com/apache/commons-lang/blob/commons-lang-3.17.0-RC1/src/main/java/org/apache/commons/lang3/RandomStringUtils.java

[gsmet]

I think we can get this in main, marked as ready.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit d37edb6.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.