build: upgrade dependencies

[keturn]

Checkmarx flagged the guava and logback versions.

Fixes #134.

I updated a few other things while I was there.

One exception is commons-vfs2: when I changed that to version 2.9.0, I was warned of transitive dependencies to a version of jackson-databind with vulnerabilities (1, 2). The current version doesn't seem to pull in jackson-databind at all. So I left well enough alone with that one.