Moxie does have these defined by default, but with transport HTTP.
Since January 2020, Maven Central only accepts HTTPS, no HTTP
anymore. So we add them here explicitly, with `https://`.
We add it to the `build.moxie` file, instead of keeping it in a
local `settings.moxie`, so that a CI server can immediately use it.

I actually don't know if it is needed for the manager and fedclient,
but right now I'm going with better safe than sorry.

Adjust the version of JaCoCo down to 0.8.4 and the version
of parboiled-java up to 1.3.1. They need to match because both
use ASM. This combination has the same dependency on ASM: 7.1.

And it seems to work, at least the docs get generated and the
`moxie test` doesn't fail building the report anymore.

Running `moxie test` will crash under Java 11 with JaCoCo 0.7.8.

This includes a fix in MINA to a CVE.

To support the new PBKDF2 password hashing, the Bouncy Castle provider
needs to be updated to a version that supports PBKDF2 with HMAC SHA265.
The current version doesn't have PBKDF2WithHmacSHA265, and neither does
Java 7, so that under Java 7 it can not be used. This update enables
the new password hashing under Java 7, too.

Update the dependency to the recommended JAF stand-alone
com.sun.activation:javax.activation:1.2.0

Updating JaCoCo in commit 23072ffb broke the build of the
HTML documentation. As found out by @chirontt, adding parboiled
as a build dependency fixes it.

Fixes #1220 and closes #1313

thanks to this dependency, one can start gitblit with java 9 without using deprecated internal module --add-modules java.activation

This reverts commit 662fb9012f.

To be able to read and migrate Lucene indices from old (4.x)
formats to new (5.x) ones, add the `lucene-backward-codecs`
library to the project.
It is added to the `ext` directory and therefore to the classpath.
According to the Lucene documentation, having it in the classpath
can affect performance. But right now the `ext` directory is the
only one available and even for a separate tool for offline
migration the library would be needed.

Exclude Lucene dependencies `lucene-spatial` and `lucene-join`.
They were added during the update but are not needed. This patch
excludes them explicitly so that they do not show up in the
generated IDE files and `ext` directory.

Bump version to 1.9.0-SNAPSHOT, increasing the minor as the next
release includes interface changes.

Use explicit coordinates, and therefor version numbers fro JUnit
in the build.moxie file. It should not be some version that just
happens to be used.

Update JUnit to latest 4.12.
Update JaCoCo to lates 0.7.8, which makes it work under Java 8.
The last used version would fail when tests are run under Java 8.

This reverts commit 55c385e96e6594ec1ac3b5cd41ccd2df6048b696, reversing
changes made to 61bb29d492.

JGit 4.0.0 fixes a memory leak but introduces a non-compatible change
for closing the RevWalk: before it was release() but now is close()