We missed a couple cases in #1433

---------

Signed-off-by: Adrian Cole <[email protected]>

This adds SECURITY.md and a scanning workflow, using Trivy. In
particular, this clarifies what we use to scan for vulnerabilities
(Trivy, not anything else), and the only channel likely to be responded
to on a significant issue (zipkin-admin email, not advisories as people
ignored them).

This is the same approach as approved and merged in
openzipkin/zipkin-reporter-java#267

Signed-off-by: Adrian Cole <[email protected]>

Signed-off-by: Adrian Cole <[email protected]>

…ifact is not published to Maven Central (#1446)

Closes #1445

Signed-off-by: Andriy Redko <[email protected]>

Routine dependency updates

Signed-off-by: Andriy Redko <[email protected]>

Closes #1440

Fixes 1043

# PR Summary
Small PR - Commit d97ee2e renamed
`spring-beans/README.md`. This PR adjusts sources to changes.

Signed-off-by: Emmanuel Ferdman <[email protected]>

Remove mention of JDBC tracing, since that used the P6Spy
instrumentation, which was removed in 6.0.

…1452)

This updates the build and all dependencies possible. Notably, we
couldn't update httpclient5 as there's a break in 5.4.

This also re-organizes property names so that mechanical updating is
easier.

---------

Signed-off-by: Adrian Cole <[email protected]>
Co-authored-by: Adrian Cole <[email protected]>