fix: exclude unused vulnerable transitive deps

- bcprov-jdk15on and bcprov-ext-jdk15on have been flagged with many
  CVEs: CVE-2020-15522, CVE-2020-0187, CVE-2020-26939, CVE-2023-33201
  for the latter, and CVE-2020-0187, CVE-2023-33201 for the former.
- these transitive deps are not used in UAA or in the library codepaths
  invoked by UAA, so excluding them to address these CVEs.
- following these 2 commits in the develop branch:
  8bdb525
  and 214e1cb
- gradle doc on the exclude statement: https://docs.gradle.org/current/userguide/dependency_downgrade_and_exclude.html#sec:excluding-transitive-deps

server/build.gradle

@@ -25,7 +25,9 @@ dependencies {
     implementation(libraries.spingSamlEsapiDependencyVersion) {
         transitive = false
     }
-    implementation(libraries.springSecuritySaml)
+    implementation(libraries.springSecuritySaml) {
+        exclude(module: "bcprov-ext-jdk15on")
+    }
     implementation(libraries.springSessionJdbc)
 
     implementation(libraries.springSecurityOauth) {
@@ -100,6 +102,7 @@ dependencies {
 configurations.all {
     exclude(group: "org.beanshell", module: "bsh-core")
     exclude(group: "org.apache-extras.beanshell", module: "bsh")
+    exclude(group: "org.bouncycastle", module: "bcprov-jdk15on")
 }
 
 jar {