Update commons-logging to latest maintenance release 1.2

We do not depend on commons-logging but have a dependency listed to commons-logging to have this module explicitly excluded. Although unused the transient dependencies are still checked. Update to 1.2 to avoid Maven trying to resolve obsolete dependencies.