[BUILD] Drop oro dependency

[art000109]

It's probably worth dropping the oro dependency. This project is retired.
https://github.com/apache/spark/blob/master/pom.xml#L157

[gaogaotiantian]

I think this probably makes sense. The project oro was retired 16 years ago - https://jakarta.apache.org/oro/ . The dependency was introduced 12 years ago as the optional dependency of ivy which should be fine without it. @dongjoon-hyun

[dongjoon-hyun]

May I ask why you ping me, @gaogaotiantian ?

[gaogaotiantian]

Oh you have been dealing with Java dependencies a lot. WDYT about this? Do you think it's okay for us to remove this very old and retired dependency?

[dongjoon-hyun]

Got it. Thank you for pinging me, @gaogaotiantian . Most recent dependency cleanup work are related to the ASF License issues actually (and wrong security complaints).

Oh you have been dealing with Java dependencies a lot.

BTW, I'm on-call this week and have very limited bandwidth and I didn't have enough thought on that topic before. Sorry about that. Feel free to proceed this in your way because the community has many eyes.

[gaogaotiantian]

@dongjoon-hyun got it! Thanks for your input! I'll leave this issue open for discussion for a few days. If no one objects I (or the author of the issue) will create a PR and ask the community for review.

[art000109]

@gaogaotiantian Thank you for your thoughts and support!
I proposed removing the dependency because I saw that it had been removed in log4j2 [LOG4J2-283]. I wasn't aware of the situation regarding Ivy.