Dependency Resolution: org.apache.maven:maven-artifact resolving org.codehaus.plexus:plexus-utils

Our vulnerability scanner is flagging a vulnerability in `org.codehaus.plexus:plexus-utils`, and it looks like it is being pulled in transitively via this library.

https://github.com/Flagsmith/flagsmith-java-client/blob/main/pom.xml#L105-L109

```
> ./gradlew :dependencyInsight --dependency org.codehaus.plexus:plexus-utils --configuration compileClasspath
org.codehaus.plexus:plexus-utils:3.2.1
\--- org.apache.maven:maven-artifact:3.6.3
+--- compileClasspath (requested org.apache.maven:maven-artifact:{strictly 3.6.3})
\--- com.flagsmith:flagsmith-java-client:8.1.1
+--- compileClasspath
```

Two questions:
1. Is this library required for run time?
2. Is the expectation that consumers pin this version to a newer one?

I also suspect its flagging what is possibly a false positive, but of course, since the scanner flags it people are complaining.