Consider shading on third party dependencies

We're currently observing issues using Citrus in projects with very old versions of common libraries. As Citrus ships newer versions as the SUT classpath provides, the version clash influences the behavior of Citrus.

E.g. Citrus allows base64 encoding using a citrus function in string literals. This for example allows on the fly creation of base64 encoded basic auth headers. As Citrus uses the Base64 implementation of apache commons, a older version of that library shipped with the SUT classpath might affect the result of that citrus functionality.

Therefore one should fixate the Citrus libraries to a specific version which cannot clash with other dependencies in the SUT classpath. One way of archiving this would be a shading of all Citrus third party dependencies. The downside would be, that Citrus has to be shipped as fat jars. So all third party dependencies (and we have a lot of those) have to be packaged with Citrus which would increase the jar size dramatically. On the other hand, even if we don't ship Citrus with dependencies, a download of the dependencies would be required anyways. So it does not make a big difference excepting that dependencies already available in the local maven repository cannot be reused.

At the moment I think the benefits of shading the Citrus dependencies would prevail the downside of bigger jar artifacts.