cxf-services-sts-core should depend on cxf-rt-rs-security-jose instead of cxf-rt-rs-security-jose-jaxrs

cxf-services-sts-core does not need to depend on cxf-rt-rs-security-jose-jaxrs; cxf-rt-rs-security-jose would be enough.

My understanding is that STS has nothing to do with JAX-RS, so there is no need to pull any JAX-RS related code via cxf-rt-rs-security-jose-jaxrs.

cxf-services-sts-systests seem to pass when cxf-rt-rs-security-jose-jaxrs is replaced by cxf-rt-rs-security-jose in cxf-services-sts-core.

Let me send a PR.