Dependencies on older log4j version

Moving this issue here from the older neptune tools repo: https://github.com/awslabs/amazon-neptune-tools/issues/265

> This project still has log4j in it.
It contains version 1.2.17 which comes thru with the use of commons-logging (neptune-export.jar/META-INF/maven/commons-logging/commons-logging/pom.xml)
It also contains version 1.2.8 which comes thru with the use of commons-configuration (neptune-export.jar/META-INF/maven/commons-configuration/commons-configuration/pom.xml)
Why is log4j 1.2.8/17 bad? while it's not log4shell, it still is a component that is just about 7 years out of support and not maintained.

> A Sonatype scan has proven to show that it has dependencies that have log4j in it. However, the resulted release may not have it included, it would be nice to see all the dependencies updated to get rid of any older unsupported open source items.

Looking at the latest neptune-export build, here's additional info on the deep dependencies on the older log4j version from both `commons-logging` and `commons-configuration`.

```
➜ neptune-export git:(develop) ✗ mvn dependency:tree | grep -A5 -B5 commons-logging
...
[INFO] +- com.amazonaws:amazon-neptune-sigv4-signer:jar:3.0.1:compile
[INFO] | +- org.apache.httpcomponents:httpclient:jar:4.5.14:compile
[INFO] | | \- commons-logging:commons-logging:jar:1.2:compile
...
```
and
```
➜ neptune-export git:(develop) ✗ mvn dependency:tree | grep -A5 -B10 commons-configuration
...
[INFO] +- org.apache.tinkerpop:gremlin-driver:jar:3.7.3:compile
[INFO] | +- org.apache.tinkerpop:gremlin-core:jar:3.7.3:compile
[INFO] | | +- org.apache.tinkerpop:gremlin-shaded:jar:3.7.3:compile
[INFO] | | +- org.apache.tinkerpop:gremlin-language:jar:3.7.3:compile
[INFO] | | | +- org.antlr:antlr4-runtime:jar:4.9.1:compile
[INFO] | | | +- org.javatuples:javatuples:jar:1.2:compile
[INFO] | | | \- org.apache.commons:commons-text:jar:1.10.0:compile
[INFO] | | +- org.apache.commons:commons-configuration2:jar:2.9.0:compile
...
```

Latest versions of both of these libraries now use log4j 2.25.3. We'll need to investigate how to address these in the downstream libraries.

Start by running `mvn dependency:tree` and tracing the `commons-logging` and `commons-configuration` paths shown in the issue. Inspect the referenced `neptune-export.jar/META-INF/maven` metadata and the downstream libraries to determine where the old log4j versions enter. Done means the dependency graph and resulting release no longer include unsupported log4j 1.x versions.

Written by the indexing model from the issue text.