Bump Apache Velocity Engine to version 2.x

## Description

We should consider moving away from the unmaintained Velocity 1.x: it starts collecting security advisories, like the one on our [Dependabot alerts page](https://github.com/apache/logging-log4j2/security/dependabot).

If we continue to use Maven Site Plugin, we need to bump its version to 4.x (which is in its alpha stage). However the current versions (2.x) of `asciidoctor-maven-plugin` are not compatible with version 4.x of Maven Site Plugin, so we are blocked until asciidoctor/asciidoctor-maven-plugin#578 is resolved.