dep: Update slf4j to 1.7.36 and switch from log4j1 to reload4j

dep: Update slf4j to 1.7.36 and switch from log4j1 to reload4j

Replace log4j 1.2.17 with reload4j 1.2.25.

log4j 1.x was caught in the fire of the Log4Shell vulnerability, even
though the 1.x line was not affected by the vulnerability. Still, this
looks bad when it shows up in security scanners even though it doesn't
mean it has the Log4Shell vulnerability.
Switch to reload4j instead. This is a drop-in replacement of log4j.
Actually, it is log4j rebooted by the same author. The reload4j 1.x
line fixes security issues that have since surfaced.

At the same time we update to the latest slf4j version, which also
switched to reload4j for the log4j12 line.