Upgrade cxf and neethi to address CVEs

[zkirksey]

What does this PR do?

Depends on #7001

Who is reviewing it?

Select relevant component teams:

Ask 2 committers to review/merge the PR and tag them here.

How should this be tested?

Any background context you want to provide?

What are the relevant tickets?

Fixes: #____

Screenshots

Checklist:

• Documentation Updated
• Update / Add Threat Dragon models
• Update / Add Unit Tests
• Update / Add Integration Tests

Notes on Review Process

Please see Notes on Review Process for further guidance on requirements for merging and abbreviated reviews.

Review Comment Legend:

• ✏️ (Pencil) This comment is a nitpick or style suggestion, no action required for approval. This comment should provide a suggestion either as an in line code snippet or a gist.
• ❓ (Question Mark) This comment is to gain a clearer understanding of design or code choices, clarification is required but action may not be necessary for approval.
• ❗ (Exclamation Mark) This comment is critical and requires clarification or action before approval.

[jrnorth]

Before merging this, it would be nice to have it as two commits: one for CXF and one for Pac4j.

[jaymcnallie]

Closing and re-opening to trigger WIP check.