Running against Apache Tomcat source identifies vulnerable dependency: Apache Tomcat

STR:

1. Grab the latest Apache Tomcat source from svn
```sh
svn checkout https://svn.apache.org/repos/asf/tomcat/trunk tomcat-trunk
```
2. Extract + Build Tomcat
```sh
cd tomcat-trunk
ant deploy
```
3. Run dependency-check against the result. One can use this ant `` to do so:
```xml

```

Two issues:

1. dependency-check identifies Tomcat as a dependency of itself
2. dependency-check misidentifies the version of Tomcat (version is 9.0.x, reports vulnerabilities on Tomcat 7.0.x)