openmrs-core: replace log4j 1 which is EOL

Thanks!

Do you think this change is valid for release 2.2.0?

I mean modules that depend on openmrs-core just need to ensure that they use the facade slf4j and not the implementations commons-logging and log4j (like we will do in the core as well lets clean up logging).