Fix CVE-2024-12798, CVE-2024-12801, CVE-2025-11226

[sandynz]

Changes proposed in this pull request:

• Upgrade logback version from 1.2.13 to 1.3.16. 1.2.x series was END-OF-LIFE, 1.3.x is suitable for Java 8.
• Upgrade slf4j version from 1.7.36 to 2.0.17 : fit logback 1.3.x series.

See https://logback.qos.ch/news.html for more details.
And there is still CVE-2026-1225 in logback 1.3.16

---

Before committing this PR, I'm sure that I have checked the following options:

• My code follows the code of conduct of this project.
• I have self-reviewed the commit code.
• I have (or in comment I request) added corresponding labels for the pull request.
• I have passed maven check locally : ./mvnw clean install -B -T1C -Dmaven.javadoc.skip -Dmaven.jacoco.skip -e.
• I have made corresponding changes to the documentation.
• I have added corresponding unit tests for my changes.
• I have updated the Release Notes of the current development version. For more details, see Update Release Note

[sandynz]

logback and slf4j jars exist in proxy distribution.