Address CVE by excluding plexus-utils
Address CVE by excluding plexus-utils

The plexus-utils dependency is upstream in this project, and triggers
a CVE for XML injection.  I was unable to find ill effect from excluding
plexus-utils as a transitive dependency.

See https://nvd.nist.gov/vuln/detail/CVE-2017-1000487

Fixes andygoossens/gradle-modernizer-plugin#1.  References #131.

Co-authored-by: Brian Oxley <714bda7fcf2205e821ff49948ab04433fb980bff@thoughtworks.com>
andrewgaul/modernizer-maven-plugin