Upgrade commons-beanutils 1.9.4

[olamy]

Proposed changelog entries

• Upgrade commons-beanutils 1.9.4. Previous version suffers from CVE-2019-10086 (GHSA-6phf-73q6-gh87). Even if we do not use this code path this will prevent some security scanning tools to report an error.

Proposed upgrade guidelines

N/A

Submitter checklist

• (If applicable) Jira issue is well described
• Changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developer, depending on the change). Examples
  • Fill-in the Proposed changelog entries section only if there are breaking changes or other changes which may require extra steps from users during the upgrade
• Appropriate autotests or explanation to why this change has no tests
• For dependency updates: links to external changelogs and, if possible, full diffs

Desired reviewers

@mention

Maintainer checklist

Before the changes are marked as ready-for-merge:

• There are at least 2 approvals for the pull request and no outstanding requests for change
• Conversations in the pull request are over OR it is explicit that a reviewer does not block the change
• Changelog entries in the PR title and/or Proposed changelog entries are correct
• Proper changelog labels are set so that the changelog can be generated automatically
• If the change needs additional upgrade steps from users, upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the PR title. (example)
• If it would make sense to backport the change to LTS, a Jira issue must exist, be a Bug or Improvement, and be labeled as lts-candidate to be considered (see query).

[MarkEWaite]

Daniel Beck mentioned in Jenkins Developers list that there have been two failed pull requests attempting to update from commons-beanutils 1.9.3 to 1.9.4. There is more to this upgrade than changing the pom.xml file.

See #4328 and #4928, along with comments in #5124.

[res0nance]

There is also #5246

[daniel-beck]

There is also #5246

Closing in favor of that.