Exclude jdbc package from log4j

[jaschdoc]

CVE-2022-23305 is caused by misconfiguration of JDBCAppender which is now removed.

I have checked that the added validation logic fails if log4j is not filtered.

Fixes #2651

[jaschdoc]

Marking as draft for now. I will extend the build files to validate that the jdbc package is gone from the built jars.

[ting-yuan]

My I know why not simply bumping log4j version, or switching to jetbrains' fork if still used, or completely removing it if not used?

Excluding the contents from the uber jar seems a bit tricky.

[jaschdoc]

My I know why not simply bumping log4j version, or switching to jetbrains' fork if still used, or completely removing it if not used?

Excluding the contents from the uber jar seems a bit tricky.

I attempted to remove it entirely, but Kotlin still requires it (and still depends on version 1.2.17.2 that we also have). We could probably update to version 1.2.17.3 since tests are green but it seems like a bad idea to introduce such a mismatch between KSP and Kotlin. For now this seems like the best local fix that we can apply.

[ting-yuan]

I see. But isn't the Kotlin compiler also suffering from the same vulnerability? How do they handle it?