Bump log4j to 2.17.1

[dblock]

Is your feature request related to a problem? Please describe.

Coming from opensearch-project/opensearch-build#1417, Log4j 2.17.1 is available with CVE-2021-44832.

OpenSearch core already upgraded, so build is failing for 1.3.0 as well.

Describe the solution you'd like
Bump log4j to 2.17.1.

[dblock]

#354 for main

[dblock]

#356