Mend scanning tool returns path_provider_android as affected by CVE-2020-8908

Looking at the code, build.gradle indeed lists guava version that is considered vulnerable.

Even if the vulnerable code is not used in the plugin, it'd be nice if this was patched.