Bump Jackson to v2.9.4 to resolve CVE-2017-15095 et al

[alex-dr]

Deletes old versions of jackson from the repository so they don't get
included in the final artifact or show up on security scans.

I really am not very comfortable with how this repo checks in binaries;
I grabbed these from mvnrepository.com, but the author or any other
contributor could have injected their own binaries with any malicious
code they want and 99.999% of consumers (read; everyone running
Logstash) would never know.

For context on upstream fix, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1506612
CVE-2017-17485: FasterXML/jackson-databind#1855
CVE-2018-5968: FasterXML/jackson-databind#1899

[guyboertje]

@alex-dr

Thanks for this.

Just so as you know, the author (me) is employed by Elastic on the Logstash team.

AFAIK, the actual downloading of the jars is done from Maven using the ruby_maven gem and jar_dependencies gems. We trust that these are fetching official jars.

I think the jars, lib/jrjackson_jars.rb and pom.xml should not be checked into the repo. They should be generated at package time.

For that reason I am going to close this and open a new one in reference to this.

[alex-dr]

Thanks @guyboertje , and I'm glad we found a better solution than using untrusted jars I uploaded :)