Remove dependency on log4J 1.x branch
Netty, and thus all downstream projects (e.g. vert.x, Quarkus etc) show a dependency on log4j-1.2.17 which as been flagged with CVE: 20-12-2019. From a vulnerability scan:

> Severity: High
>
> CVE: 20-12-2019
>
> Description: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
>
> Published: 20-12-2019
>
> Top Fix: 
> Upgrade to version org.apache.logging.log4j:log4j-core:2.0.  The reported vulnerability was not checked for vulnerability effectiveness and is suggested to be examined using Effective Usage Analysis.

There are 2 occurrences that need upgrade:

https://github.com/netty/netty/blob/ccca3959fd64b133edca855925fb68d077c3a8a2/common/src/main/java/io/netty/util/internal/logging/Log4JLoggerFactory.java#L18

Replace with:

```java
import org.apache.logging.log4j.Logger;
```

https://github.com/netty/netty/blob/d34212439068091bcec29a8fad4df82f0a82c638/common/src/main/java/io/netty/util/internal/logging/Log4JLogger.java#L42-L43

Replace with:

```java
import org.apache.logger.log4j.Level;
import org.apache.logger.log4j.Logger;
```

common/pom.xml pom.xml
common/pom.xml pom.xml
diff --git a/common/pom.xml b/common/pom.xml
index 15a5dc12679..a930b94f1bd 100644
--- a/common/pom.xml
+++ b/common/pom.xml
@@ -64,8 +64,8 @@
       <optional>true</optional>
     </dependency>
     <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-1.2-api</artifactId>
       <optional>true</optional>
     </dependency>
     <dependency>
diff --git a/pom.xml b/pom.xml
index e677a89ff05..1478851ace8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -728,9 +728,9 @@
         <version>${log4j2.version}</version>
       </dependency>
       <dependency>
-        <groupId>log4j</groupId>
-        <artifactId>log4j</artifactId>
-        <version>1.2.17</version>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-1.2-api</artifactId>
+        <version>2.14.1</version>
         <exclusions>
           <exclusion>
             <artifactId>mail</artifactId>
