Globally forbid and exclude known bad dependencies

There are some known dependencies that we don't want to include in the project like:

• commons-logging since we use slf4j
• jsr305 - since there are license issues

This should be accomplished globally so we don't need to do this in each module.