Investigate and potentially remove Log4j dependency management #51388

Description

Keycloak currently manages Log4j dependencies (e.g. log4j2-api) even though Log4j is not actually used by Keycloak. The dependency management was introduced in #36758 (comment) to fix Log4j dependencies when running org.keycloak.Keycloak in the junit5 module from the IDE, aligning with Quarkus. It is also kept managed to avoid false positives from security scanners (see discussion #50158).

As highlighted during the Quarkus 3.33.3 upgrade (#51346), this managed dependency causes friction: Dependabot bumped log4j2-api to 2.25.4 independently of the Quarkus BOM, and it had to be manually reverted to 2.25.3 to stay aligned with Quarkus.

Task:

• Investigate whether the Log4j dependency management is still needed (e.g. whether the original junit5/IDE issue still exists).
• If it is no longer needed, remove it to avoid maintenance overhead and misaligned Dependabot bumps.
• If it is still needed, document the reason as a comment on that dependency, and align the version with Quarkus back again.